CVE-2025-23301

MediumCVSS 4.2/10Last modified Oct 18, 2026

Description

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-1244

Affected software

VendorProductVersions
NVIDIAHGX, DGX HopperAll versions prior to and including 1.7.1
NVIDIAHGX, DGX BlackwellAll versions prior to and including 1.2.0

References

Timeline

Published
Sep 4, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-233024.2NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access levelCVE-2025-233039.8NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote codeCVE-2025-233049.8NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection CVE-2025-233057.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. CVE-2025-233067.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could causeCVE-2025-233077.8NVIDIA NeMo Curator for all platforms contains a vulnerability where a malicious file created by an attacker could allow code injection. A sCVE-2025-233087.8NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by gettiCVE-2025-233098.2NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation CVE-2025-23316.5The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions uCVE-2025-233109.8NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by specialCVE-2025-233119.8NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requesCVE-2025-233127.8NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an att
CVE-2025-23301: Medium severity, CVSS 4.2 | Vulnix