{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:00:28.845002Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:00:36.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "nRF54H20",
          "vendor": "Nordic Semiconductor ASA",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "status": "affected",
              "version": "3.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Reported externally through PSIRT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eWhen using the Direct XIP\nupdate strategy, the main application image starts other cores (i.e. radio\ncore), based on the currently active slot without additional verification. The\nMCUboot in the bare (upstream) configuration assumes that if there is at least\na single slot for each image available, the system is bootable and continues\nthe boot process. This may lead to a situation when MCUboot picks different\nslot for different images (i.e. (a) for the main application and (b) for the\nradio image), boots the main application (from slot (a)) that afterwards starts\nthe radio image by providing an address of the unauthenticated slot ((a)\ninstead of (b)).\u003c/span\u003e"
            }
          ],
          "value": "When using the Direct XIP\nupdate strategy, the main application image starts other cores (i.e. radio\ncore), based on the currently active slot without additional verification. The\nMCUboot in the bare (upstream) configuration assumes that if there is at least\na single slot for each image available, the system is bootable and continues\nthe boot process. This may lead to a situation when MCUboot picks different\nslot for different images (i.e. (a) for the main application and (b) for the\nradio image), boots the main application (from slot (a)) that afterwards starts\nthe radio image by providing an address of the unauthenticated slot ((a)\ninstead of (b))."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-549",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-549 Local Execution of Code"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T07:58:09.190Z",
        "orgId": "30a5e7fb-040d-440a-8cdf-a4a2068ce72e",
        "shortName": "YesWeHack"
      },
      "references": [
        {
          "url": "https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "nRF54H20: MCUBoot can be tricked to executing unauthenticated code",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "30a5e7fb-040d-440a-8cdf-a4a2068ce72e",
    "assignerShortName": "YesWeHack",
    "cveId": "CVE-2026-14296",
    "datePublished": "2026-09-07T07:58:09.190Z",
    "dateReserved": "2026-07-01T09:51:22.466Z",
    "dateUpdated": "2026-09-08T15:00:36.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14296\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-08T15:00:28.845002Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-08T15:00:33.721Z\"}}], \"cna\": {\"title\": \"nRF54H20: MCUBoot can be tricked to executing unauthenticated code\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Reported externally through PSIRT\"}], \"impacts\": [{\"capecId\": \"CAPEC-549\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-549 Local Execution of Code\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Nordic Semiconductor ASA\", \"product\": \"nRF54H20\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"affected\", \"version\": \"3.3\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"When using the Direct XIP\\nupdate strategy, the main application image starts other cores (i.e. radio\\ncore), based on the currently active slot without additional verification. The\\nMCUboot in the bare (upstream) configuration assumes that if there is at least\\na single slot for each image available, the system is bootable and continues\\nthe boot process. This may lead to a situation when MCUboot picks different\\nslot for different images (i.e. (a) for the main application and (b) for the\\nradio image), boots the main application (from slot (a)) that afterwards starts\\nthe radio image by providing an address of the unauthenticated slot ((a)\\ninstead of (b)).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan\u003eWhen using the Direct XIP\\nupdate strategy, the main application image starts other cores (i.e. radio\\ncore), based on the currently active slot without additional verification. The\\nMCUboot in the bare (upstream) configuration assumes that if there is at least\\na single slot for each image available, the system is bootable and continues\\nthe boot process. This may lead to a situation when MCUboot picks different\\nslot for different images (i.e. (a) for the main application and (b) for the\\nradio image), boots the main application (from slot (a)) that afterwards starts\\nthe radio image by providing an address of the unauthenticated slot ((a)\\ninstead of (b)).\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347 Improper verification of cryptographic signature\"}]}], \"providerMetadata\": {\"orgId\": \"30a5e7fb-040d-440a-8cdf-a4a2068ce72e\", \"shortName\": \"YesWeHack\", \"dateUpdated\": \"2026-09-07T07:58:09.190Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-14296\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T15:00:36.748Z\", \"dateReserved\": \"2026-07-01T09:51:22.466Z\", \"assignerOrgId\": \"30a5e7fb-040d-440a-8cdf-a4a2068ce72e\", \"datePublished\": \"2026-09-07T07:58:09.190Z\", \"assignerShortName\": \"YesWeHack\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}