CVE-2025-23337 Details
Description
NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
A vulnerability exists in the HGX Management Controller (HMC) of NVIDIA HGX and DGX systems, specifically in the GB200, GB300, and B300 versions. This vulnerability may allow a malicious actor with administrative access on the Baseboard Management Controller (BMC) to gain unauthorized administrative access to the HMC. Exploitation of this vulnerability could result in code execution, denial of service, unauthorized privilege escalation, information disclosure, and data tampering.
NVIDIA has released a software update for the affected products. Users should download and install the latest update from the NVIDIA Developer Tools page. For specific version details, refer to the NVIDIA security bulletin.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2025CISA-ADP
Assessed Sep 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://nvidia.custhelp.com/app/answers/detail/a_id/5692 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NVIDIA HGX Management Controller | All versions |
CPE
Remediation
| |
| NVIDIA DGX GB200 | All versions |
CPE
Remediation
| |
| NVIDIA DGX GB300 | All versions |
CPE
Remediation
| |
| NVIDIA DGX B300 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2025 | New CVE Received | [email protected] |