Read the docs
TI-2026-06067 Aliases CVE-2026-6923GHSA-j7g5-cj58-4v5f

Nuvoton - CWE-1300: Improper Protection of Physical Side Channels

Priority LOW 17CWE-1300Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00117 1st percentileScored 2026-11-07
Fix Fixed NPCT7xx (Nuvoton): 7.2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NuvotonNPCT7xxbefore 7.2.4.07.2.4.0Patch availableCNA
  • NPCT7xx VendorNuvoton Affected before 7.2.4.0 Fixed in 7.2.4.0 Patch available CNA

Remediation

  • Fix · CNA NPCT7xx (Nuvoton) Fixed in 7.2.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6923
  2. 2026-10-03 Alias added: GHSA-j7g5-cj58-4v5f

References

Other 1

  • TI-2024-25683 Authentication bypass in Nuvoton NPCM7xx BootBlock CVSS 3.1MEDIUM 6.7
  • TI-2021-11994 In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with… CVSS 3.1MEDIUM 6.0
  • TI-2020-15336 An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before… CVSS 3.1LOW 3.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences