CVE-2025-23299

MediumCVSS 6.7/10Last modified Oct 18, 2026

Description

NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
NVIDIABlueField GAAll versions prior to 46.1006
NVIDIABlueField LTS22All versions prior to 35.4554
NVIDIABlueField LTS23All versions prior to 39.5050
NVIDIABlueField LTS24All versions prior to 43.3608
NVIDIAConnectX GAAll versions prior to 46.1006
NVIDIAConnectX LTS22All versions prior to 35.4554
NVIDIAConnectX LTS23All versions prior to 39.5050
NVIDIAConnectX LTS24All versions prior to 43.3608
NVIDIAConnectX-4 LXAll versions prior to 32.1908

References

Timeline

Published
Oct 22, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-23305.4The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+mCVE-2025-233005.5NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocaCVE-2025-233014.2NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access leveCVE-2025-233024.2NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access levelCVE-2025-233039.8NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote codeCVE-2025-233049.8NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection CVE-2025-233057.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. CVE-2025-233067.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could causeCVE-2025-233077.8NVIDIA NeMo Curator for all platforms contains a vulnerability where a malicious file created by an attacker could allow code injection. A sCVE-2025-233087.8NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by gettiCVE-2025-233098.2NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation CVE-2025-23316.5The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u
CVE-2025-23299: Medium severity, CVSS 6.7 | Vulnix