CVE-2025-23351
CRITICAL 9NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.
ELEVATED IMPACT
Severe if exploited (CVSS 9), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
—EPSS not yet scored
○ In CISA KEV
○ Public exploit / PoC
Impact if exploited
9CVSS 3.1 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Affected
Vendors Nvidia
Products Bluefield Ga Bluefield Lts22 Bluefield Lts23 Bluefield Lts24 Connectx Ga Connectx Lts22 Connectx Lts23 Connectx Lts24
Weakness (CWE)
- CWE-787: Out-of-bounds write
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H