CVE-2025-33187CWE-269

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas

Critical · published November 25, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

🚨 A single vulnerability in NVIDIA DGX Spark GB10 could grant attackers privileged access to sensitive SoC areas. 🔥 Think of it like a VIP pass that slips by security, letting the bearer into restricted sections of a high-tech facility where confidential data is stored. Without proper checks, this pass could enable a rogue agent to tamper with crucial operations or even cause a shutdown! This flaw creates a playground for attackers, potentially allowing them to execute arbitrary code, disclose sensitive information, tamper with data, or escalate their privileges. The consequences could range from operational disruptions to catastrophic security breaches, making this a critical issue that demands immediate attention!

Put simply

Think of it like a VIP pass that slips by security, letting the bearer into restricted sections of a high-tech facility where confidential data is stored. Without proper checks, this pass could enable a rogue agent to tamper with crucial operations or even cause a shutdown! The vulnerability in SROOT allows attackers with privileged access to breach SoC protected areas, leading to severe security implications. Exploiting this flaw could result in unauthorized actions taken on the device, jeopardizing overall system integrity.

What to do

This flaw creates a playground for attackers, potentially allowing them to execute arbitrary code, disclose sensitive information, tamper with data, or escalate their privileges. The consequences could range from operational disruptions to catastrophic security breaches, making this a critical issue that demands immediate attention! Immediately audit access controls and permissions to ensure that only trusted users have privileged access. Consider patching your systems with the latest updates from NVIDIA to mitigate this vulnerability and train your team on best practices for managing sensitive systems. Be proactive! You've got this! With the right steps, you can secure your systems and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-11-25T17:57Z
EPSS history
Timeline
  • 25 NOV 17:57Z
    NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas
    cvelistv5