CVE-2025-33179
Published: 24 February 2026
Description
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successful exploit of this vulnerability might lead to escalation of privileges.
Mitigating Controls (NIST 800-53 r5)AI
AC-6 enforces least privilege, directly preventing low-privileged users from executing unauthorized commands that lead to privilege escalation in the NVUE interface due to incorrect privilege assignment.
AC-3 requires systems to enforce approved access control policies, blocking low-privileged users from running escalated commands via the vulnerable NVUE interface.
AC-2 provides account management processes to review and correct privilege assignments, mitigating risks from low-privileged accounts exploiting the NVUE vulnerability.
Security SummaryAI
CVE-2025-33179 affects NVIDIA Cumulus Linux and NVOS products through a vulnerability in the NVUE interface. This flaw allows a low-privileged user to execute an unauthorized command, which could result in escalation of privileges. The issue is rated with a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-266 (Incorrect Privilege Assignment for Critical Resource) along with NVD-CWE-noinfo.
Exploitation requires an attacker to have low privileges (PR:L) and adjacent network access (AV:A), with low attack complexity and no user interaction needed. A successful attack can achieve high impacts on confidentiality, integrity, and availability, primarily enabling privilege escalation from the low-privileged state.
Mitigation guidance is available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5722, the NVD detail page at https://nvd.nist.gov/vuln/detail/CVE-2025-33179, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33179. The vulnerability was published on 2026-02-24.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables low-privileged users to execute unauthorized commands resulting in privilege escalation, directly facilitating T1068: Exploitation for Privilege Escalation.