CVE-2025-23262

MediumCVSS 6.3/10Last modified Oct 18, 2026

Description

NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
NVIDIA	ConnectX GA	All versions prior to 45.1020
NVIDIA	ConnectX LTS22	All versions prior to 35.4554
NVIDIA	ConnectX LTS23	All versions prior to 39.5050
NVIDIA	ConnectX LTS24	All versions prior to 43.3608
NVIDIA	ConnectX-4	All versions prior to 12.28.2704
NVIDIA	ConnectX-4 LX	All versions prior to 14.32.1908

References

Timeline

Published: Sep 4, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-232637.6NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileg CVE-2025-232647.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232657.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232669.0NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could CVE-2025-232678.5NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followi CVE-2025-232689.8NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. CVE-2025-232694.7NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared CVE-2025-23275.1A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.CVE-2025-232707.1NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive i CVE-2025-232713.3NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passin CVE-2025-232725.7NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. CVE-2025-232734.7NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a divide by zero error b