What is the CVSS score of CVE-2025-33181?

CVE-2025-33181 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvos are affected by CVE-2025-33181?

NVIDIA Cumulus Linux and NVOS products contain a command injection vulnerability that could allow low-privileged users to escalate privileges and gain unauthorized system access.

How to fix or mitigate CVE-2025-33181?

Within 24 hours: Inventory all NVIDIA Cumulus Linux and NVOS deployments and restrict NVUE interface access to trusted administrators only. Within 7 days: Implement network segmentation to isolate affected devices and disable NVUE interface where operationally feasible. Within 30 days: Monitor vendor advisories for patch availability and establish an expedited deployment plan; consider architectural review of alternative NOS solutions if patch timeline extends beyond 60 days.

Nvos CVE-2025-33181

HIGH

Command Injection (CWE-77)

2026-02-24 psirt@nvidia.com

Linux Privilege Escalation Nvos Cumulus Linux

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 20:27 nvd

HIGH 7.3

DescriptionCVE.org

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

AnalysisAI

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects the a vulnerability in the NVUE component of Cumulus Linux. NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.