CVE-2025-33180
Received Received - Intake

Command Injection in NVIDIA NVUE Interface Enables Privilege Escalation

Publication date: 2026-02-24

Last updated on: 2026-02-27

Assigner: NVIDIA Corporation

Description
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-24
Last Modified
2026-02-27
Generated
2026-07-06
AI Q&A
2026-02-24
EPSS Evaluated
2026-07-05
NVD
CVE-2025-33180
EUVD
EUVD-2025-208099

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
nvidia cumulus_linux to 5.14.0 (exc)
nvidia cumulus_linux From 5.11.0 (inc) to 5.11.4 (exc)
nvidia cumulus_linux From 5.9.0 (inc) to 5.9.4 (exc)
nvidia nvos to 25.02.2452 (exc)
nvidia nvos to 25.02.4282 (exc)
nvidia nvos to 25.02.5030 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

Exploiting this vulnerability can allow an attacker with low privileges to execute arbitrary commands and escalate their privileges on the affected system.

This can result in a high impact on confidentiality, integrity, and availability of the system, potentially allowing unauthorized access, data manipulation, or disruption of services.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

CVE-2025-33180 is a vulnerability in NVIDIA Cumulus Linux and NVOS products, specifically in the NVUE interface. It allows a low-privileged user to inject commands, which means they can execute arbitrary commands on the system.

This command injection flaw can lead to escalation of privileges, enabling the attacker to gain higher-level access than originally permitted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-33180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart