CVE-2025-23262 - Vulnerability Details - OpenCVE

NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nvidia	Connectx Connectx-4 Connectx-5

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-23262
https://nvidia.custhelp.com/app/answers/detail/a_id/5655
https://www.cve.org/CVERecord?id=CVE-2025-23262

History

Fri, 05 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nvidia Nvidia connectx Nvidia connectx-4 Nvidia connectx-5
Vendors & Products		Nvidia Nvidia connectx Nvidia connectx-4 Nvidia connectx-5

Thu, 04 Sep 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 04 Sep 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.
Weaknesses		CWE-863
References		https://nvd.nist.gov/vuln/detail/CVE-2025-23262 https://nvidia.custhelp.com/app/answers/detail/a_id/5655 https://www.cve.org/CVERecord?id=CVE-2025-23262
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2025-09-04T15:52:49.201Z

Updated: 2025-09-04T18:57:38.048Z

Reserved: 2025-01-14T01:06:23.291Z

Link: CVE-2025-23262

Vulnrichment

Updated: 2025-09-04T18:51:24.905Z

NVD

Status : Awaiting Analysis

Published: 2025-09-04T16:15:34.677

Modified: 2025-09-05T17:47:24.833

Link: CVE-2025-23262

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23262", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2025-01-14T01:06:23.291Z", "datePublished": "2025-09-04T15:52:49.201Z", "dateUpdated": "2025-09-04T18:57:38.048Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7", "ConnectX-8"], "product": "ConnectX GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 45.1020"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX-5", "ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "product": "ConnectX LTS22", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 35.4554"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "product": "ConnectX LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 39.5050"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "product": "ConnectX LTS24", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 43.3608"}]}, {"defaultStatus": "unaffected", "platforms": ["N/A-12.28"], "product": "ConnectX-4", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 12.28.2704"}]}, {"defaultStatus": "unaffected", "platforms": ["N/A-14.32"], "product": "ConnectX-4 LX", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 14.32.1908"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": true, "type": "text/html", "value": "NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering."}], "value": "NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges, Denial of Service, Data Tampering, Information Disclosure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-04T15:52:49.201Z"}, "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23262"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23262"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5655"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-04T18:51:22.742008Z", "id": "CVE-2025-23262", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-04T18:57:38.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-04T18:51:22.742008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-04T18:51:24.905Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges, Denial of Service, Data Tampering, Information Disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "ConnectX GA", "versions": [{"status": "affected", "version": "All versions prior to 45.1020"}], "platforms": ["ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7", "ConnectX-8"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS22", "versions": [{"status": "affected", "version": "All versions prior to 35.4554"}], "platforms": ["ConnectX-5", "ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS23", "versions": [{"status": "affected", "version": "All versions prior to 39.5050"}], "platforms": ["ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS24", "versions": [{"status": "affected", "version": "All versions prior to 43.3608"}], "platforms": ["ConnectX-6", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4", "versions": [{"status": "affected", "version": "All versions prior to 12.28.2704"}], "platforms": ["N/A-12.28"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4 LX", "versions": [{"status": "affected", "version": "All versions prior to 14.32.1908"}], "platforms": ["N/A-14.32"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23262"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23262"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5655"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-04T15:52:49.201Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23262", "state": "PUBLISHED", "dateUpdated": "2025-09-04T18:57:38.048Z", "dateReserved": "2025-01-14T01:06:23.291Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2025-09-04T15:52:49.201Z", "assignerShortName": "nvidia"}, "dataVersion": "5.1"}