CVE-2025-33180

EUVD-2025-208099
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8 HIGH
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
nvidiacumulus_linux
𝑥
< 5.14.0
nvidiacumulus_linux
5.9.0 ≤
𝑥
< 5.9.4
nvidiacumulus_linux
5.11.0 ≤
𝑥
< 5.11.4
nvidianvos
𝑥
< 25.02.2452
nvidianvos
𝑥
< 25.02.4282
nvidianvos
𝑥
< 25.02.5030
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://nvd.nist.gov/vuln/detail/CVE-2025-33180
https://nvidia.custhelp.com/app/answers/detail/a_id/5722
https://www.cve.org/CVERecord?id=CVE-2025-33180