CVE-2025-33207

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

Score

CVSS 3.1 6.8 Medium

Status

Awaiting Analysis - psirt@nvidia.com

Published

2026-09-29

Last modified

2026-10-14

Weaknesses

CWE-1262

Affected products

• Bluefield Ga (Nvidia)
• Bluefield Lts23 (Nvidia)
• Bluefield Lts24 (Nvidia)
• Connectx-5 (Nvidia)
• Connectx Ga (Nvidia)
• Connectx Lts23 (Nvidia)
• Connectx Lts24 (Nvidia)

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-33207
• https://www.cve.org/CVERecord?id=CVE-2025-33207
• https://github.com/NVIDIA/product-security/tree/main/2026/5847