CVE-2025-33180
Command Injection in NVIDIA NVUE Interface Enables Privilege Escalation
Publication date: 2026-02-24
Last updated on: 2026-02-27
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | cumulus_linux | to 5.14.0 (exc) |
| nvidia | cumulus_linux | From 5.11.0 (inc) to 5.11.4 (exc) |
| nvidia | cumulus_linux | From 5.9.0 (inc) to 5.9.4 (exc) |
| nvidia | nvos | to 25.02.2452 (exc) |
| nvidia | nvos | to 25.02.4282 (exc) |
| nvidia | nvos | to 25.02.5030 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Exploiting this vulnerability can allow an attacker with low privileges to execute arbitrary commands and escalate their privileges on the affected system.
This can result in a high impact on confidentiality, integrity, and availability of the system, potentially allowing unauthorized access, data manipulation, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
CVE-2025-33180 is a vulnerability in NVIDIA Cumulus Linux and NVOS products, specifically in the NVUE interface. It allows a low-privileged user to inject commands, which means they can execute arbitrary commands on the system.
This command injection flaw can lead to escalation of privileges, enabling the attacker to gain higher-level access than originally permitted.