NVIDIA Isaac Launchable CVE-2025-33223

The input does not name a specific feature, protocol or configuration toggle - NVIDIA's description only states that Isaac Launchable performs 'an execution with unnecessary privileges' (CWE-250), meaning the launch component runs in a more privileged context than required. The vendor CVSS vector claims no special conditions (PR:N/UI:N/AC:L), implying unauthenticated remote reachability against affected Isaac Launchable 1.0, but CWE-250 typically requires that an attacker first be able to influence what the over-privileged process executes (e.g. reaching the launch mechanism or supplying input it runs), which usually presupposes network/service exposure or an existing foothold. Limiting factors: affected scope is restricted to Isaac Launchable version 1.0 (a niche robotics tool), exploitation realistically depends on the over-privileged launch path being exposed, and the exact prerequisite must be confirmed from NVIDIA advisory 5749 before assuming default-configuration remote exploitation.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a remotely exploitable, unauthenticated flaw with full impact to confidentiality, integrity and availability. However, the underlying weakness is CWE-250 (Execution with Unnecessary Privileges), which almost always manifests as a privilege/context problem reached through an existing foothold rather than a direct remote network entry point - so the AV:N/PR:N labeling is in tension with the CWE and with the deliberately vague NVIDIA description ('could cause an execution with unnecessary privileges'). This should be verified with NVIDIA advisory 5749, because CWE-250 flaws are frequently local/config-dependent despite high CVSS scores. Supporting exploitation signals are modest and do not corroborate the Critical rating: EPSS is only 0.69% (52nd percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. The combination (very high CVSS but low EPSS, no KEV, no POC, and a CWE that implies constrained preconditions) suggests this is a theoretically severe but not yet actively exploited issue - patch on a normal-to-prompt cycle rather than emergency, and confirm the true attack vector with the vendor before treating it as internet-facing unauthenticated RCE.

An attacker who can reach an affected NVIDIA Isaac Launchable deployment leverages the component's execution with unnecessary privileges to run code in a higher-privileged context, resulting in code execution, privilege escalation, data tampering, information disclosure or denial of service. No public exploit code was identified at time of analysis, and the precise entry point is under-specified by the vendor; the CVSS claim of low-complexity unauthenticated network access (AV:N/AC:L/PR:N) should be validated against NVIDIA advisory 5749 since CWE-250 often requires a prior local foothold.