CVE-2025-33181
Command Injection in NVIDIA NVUE Interface Enables Privilege Escalation
Publication date: 2026-02-24
Last updated on: 2026-02-27
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | cumulus_linux | to 5.14.0 (exc) |
| nvidia | cumulus_linux | From 5.11.0 (inc) to 5.11.4 (exc) |
| nvidia | cumulus_linux | From 5.9.0 (inc) to 5.9.4 (exc) |
| nvidia | nvos | to 25.02.2452 (exc) |
| nvidia | nvos | to 25.02.4282 (exc) |
| nvidia | nvos | to 25.02.5030 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-33181 is a vulnerability in NVIDIA Cumulus Linux and NVOS products, specifically in the NVUE interface.
The flaw allows a low-privileged user to inject commands, meaning they can execute arbitrary commands that they should not normally be able to run.
This happens because the input in the NVUE interface is not properly sanitized, leading to command injection.
A successful exploit can lead to escalation of privileges, giving the attacker higher-level access than originally permitted.
How can this vulnerability impact me? :
Exploiting this vulnerability can allow an attacker with low privileges and local access to execute arbitrary commands on the affected system.
This can lead to escalation of privileges, meaning the attacker can gain higher-level access and control over the system.
The impact is high on confidentiality, integrity, and availability of the system, potentially allowing unauthorized data access, modification, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know