CVE-2025-0040

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially resulting in loss of data integrity or confidentiality.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 15, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-00414.6Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user CVE-2025-00444.8An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial los CVE-2025-00456.9Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, pot CVE-2025-00467.0Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.CVE-2025-00494.3When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes th CVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha CVE-2025-00518.7Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.CVE-2025-00528.3Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.CVE-2025-00535.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a CVE-2025-00545.4SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The CVE-2025-00556.0SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrati CVE-2025-00566.0SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�