CVE-2025-54515

LowCVSS 1.0/10Last modified Oct 18, 2026

Description

The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.

Metrics

CVSS 4.0 1.0/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-545178.5Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.CVE-2025-545187.0Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruction CVE-2025-545197.3A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary co CVE-2025-54526.6A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to pot CVE-2025-545208.6Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platfo CVE-2025-545257.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant CVE-2025-545267.8Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may CVE-2025-545276.1In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allow CVE-2025-545288.8In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow CVE-2025-545297.5In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration CVE-2025-545309.8In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions CVE-2025-545319.4In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows