CVE-2025-23299

State: Published
Severity: 6.7 Medium
Published: Oct 22, 2025
Updated: Oct 22, 2025
Reserved: Jan 14, 2025

Description

NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	nvidia

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
BlueField GANVIDIA	All versions prior to 46.1006Affected
BlueField LTS22NVIDIA	All versions prior to 35.4554Affected
BlueField LTS23NVIDIA	All versions prior to 39.5050Affected
BlueField LTS24NVIDIA	All versions prior to 43.3608Affected
ConnectX GANVIDIA	All versions prior to 46.1006Affected
ConnectX LTS22NVIDIA	All versions prior to 35.4554Affected
ConnectX LTS23NVIDIA	All versions prior to 39.5050Affected
ConnectX LTS24NVIDIA	All versions prior to 43.3608Affected
ConnectX-4 LXNVIDIA	All versions prior to 32.1908Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.