CVE-2025-33207

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/NVIDIA/product-security/tree/main/2026/5847
https://nvd.nist.gov/vuln/detail/CVE-2025-33207
https://www.cve.org/CVERecord?id=CVE-2025-33207

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) NVIDIA ConnectX y Bluefield contienen una vulnerabilidad en un registro de control, donde un usuario con acceso VF podría causar un control de acceso inadecuado para la interfaz del registro al enviar un comando malicioso al firmware. Un exploit exitoso de esta vulnerabilidad podría conducir a una denegación de servicio.

29 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-29 15:17

Updated : 2026-10-14 13:10

NVD link : CVE-2025-33207

Mitre link : CVE-2025-33207

CVE.ORG link : CVE-2025-33207

JSON object : View

Products Affected

No product.

CWE

CWE-1262

Improper Access Control for Register Interface

{"id": "CVE-2025-33207", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-33207", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T15:11:46.490573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "BlueField GA", "versions": [{"status": "affected", "version": "All versions prior to 47.1020"}], "platforms": ["BlueField-2"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS23", "versions": [{"status": "affected", "version": "All versions prior to 39.5124"}], "platforms": ["BlueField-2"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS24", "versions": [{"status": "affected", "version": "All versions prior to 43.4100"}], "platforms": ["BlueField-2"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX GA", "versions": [{"status": "affected", "version": "All versions prior to 47.1020"}], "platforms": ["ConnectX-6 DE, ConnectX-6 DX, ConnectX-6 LX"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS23", "versions": [{"status": "affected", "version": "All versions prior to 39.5124"}], "platforms": ["ConnectX-6, ConnectX-6 DE, ConnectX-6 DX, ConnectX-6 LX"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS24", "versions": [{"status": "affected", "version": "All versions prior to 43.4100"}], "platforms": ["ConnectX-6, ConnectX-6 DE, ConnectX-6 DX, ConnectX-6 LX"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-5", "versions": [{"status": "affected", "version": "All versions prior to 16.35.8008"}], "platforms": ["ConnectX-5"], "defaultStatus": "unaffected"}]}], "published": "2026-09-29T15:17:12.293", "references": [{"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5847", "source": "psirt@nvidia.com"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33207", "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-33207", "source": "psirt@nvidia.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-1262"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service."}, {"lang": "es", "value": "NVIDIA ConnectX y Bluefield contienen una vulnerabilidad en un registro de control, donde un usuario con acceso VF podr\u00eda causar un control de acceso inadecuado para la interfaz del registro al enviar un comando malicioso al firmware. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "psirt@nvidia.com"}