What is the CVSS score of CVE-2025-33181?

CVE-2025-33181 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cumulus Linux are affected by CVE-2025-33181?

NVIDIA Cumulus Linux and NVOS products contain a command injection vulnerability that could allow low-privileged users to escalate privileges and gain unauthorized system access.

How to fix or mitigate CVE-2025-33181?

Within 24 hours: Inventory all NVIDIA Cumulus Linux and NVOS deployments and restrict NVUE interface access to trusted administrators only. Within 7 days: Implement network segmentation to isolate affected devices and disable NVUE interface where operationally feasible. Within 30 days: Monitor vendor advisories for patch availability and establish an expedited deployment plan; consider architectural review of alternative NOS solutions if patch timeline extends beyond 60 days.

Cumulus Linux CVE-2025-33181

HIGH

Command Injection (CWE-77)

2026-02-24 psirt@nvidia.com

Privilege Escalation Linux Cumulus Linux Nvos Nvidia

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 20:27 nvd

HIGH 7.3

DescriptionCVE.org

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

AnalysisAI

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects the a vulnerability in the NVUE component of Cumulus Linux. NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.