CVE-2025-33207

Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in NVIDIA ConnectX and Bluefield Firmware

Publication date: 2026-09-29

Last updated on: 2026-10-14

Assigner: NVIDIA Corporation

Description

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2025-33207

EUVD

EUVD-2025-211016

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	connectx	*
nvidia	bluefield	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1262	The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.

Attack-Flow Graph

Executive Summary

NVIDIA ConnectX and Bluefield devices have a vulnerability in a control register. A user with Virtual Function (VF) access can send a malicious command to the firmware, causing improper access control for the register interface. This may result in a denial of service condition.

Detection Guidance

Detection of this vulnerability requires checking for improper access control in NVIDIA ConnectX or Bluefield firmware registers. Review system logs for unexpected VF access attempts or firmware command failures. Monitor for denial of service conditions affecting network interfaces.

Impact Analysis

If exploited, this vulnerability could lead to a denial of service, disrupting the availability of affected NVIDIA ConnectX or Bluefield devices. Users with VF access could potentially trigger this issue.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability allows a user with VF access to cause improper access control, potentially leading to denial of service. This could indirectly affect compliance by disrupting data availability or integrity, but no explicit compliance implications are mentioned in the available context.

Mitigation Strategies

Apply the latest firmware updates provided by NVIDIA for ConnectX and Bluefield devices to address the improper access control vulnerability in the control register.

Hi! I’m here to help you understand CVE-2025-33207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70