Riskcovery

CVE-2025-33180

State
Published
Severity
8.0 High
Published
Feb 24, 2026
Updated
Feb 24, 2026
Reserved
Apr 15, 2025

Read the record on cve.org

Description

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hnvidia

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
Cumulus Linux GANVIDIA
  • All versions prior to 5.14 (5.13.x, 5.12.x, and older GA versions)Affected
Cumulus Linux LTSNVIDIA
  • All versions prior to 5.11.4Affected
Cumulus Linux LTSNVIDIA
  • All versions prior to 5.9.4Affected
NVOSNVIDIA
  • All versions prior to 1.3 - 25.02.244Affected
NVOSNVIDIA
  • All versions prior to 25.02.4282Affected
NVOSNVIDIA
  • All versions prior to 25.02.5030Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.