CVE-2025-33182
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | jetson_linux | 35.6.2 |
| nvidia | jetson_linux | 35.6.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-33182 is a high-severity vulnerability in the UEFI implementation of NVIDIA Jetson Linux. It involves improper authentication that allows a privileged user to corrupt the Linux Device Tree. This vulnerability is classified as CWE-862 (Improper Authorization). [1]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to data tampering and denial of service on affected NVIDIA Jetson Linux devices. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves verifying the version of Jetson Linux running on your NVIDIA Jetson Orin Series device. Specifically, check if the version is 35.6.2 or earlier, as these are affected. There are no specific commands provided to detect exploitation or presence of the vulnerability directly. You can check the installed Jetson Linux version using commands like 'dpkg -l | grep jetson-linux' or 'apt-cache policy' on the device to determine the installed package version. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update your NVIDIA Jetson Linux to version 35.6.3 or newer, where the issue is resolved. The update can be obtained and installed from the APT server or the Jetson Download Center. Applying this update will fix the improper authentication issue in UEFI and prevent potential data tampering or denial of service. [1]