Nvidia EUVD-2025-208971

While the CVSS score of 5.9 (Medium) indicates moderate severity, the real-world exploitation risk is significantly constrained by multiple factors. The CVSS vector requires high privileges (PR:H), high attack complexity (AC:H), and network access (AV:N), creating a high barrier to entry. SSVC decision framework confirms this assessment: exploitation status is 'none' (no known public exploits), the vulnerability is not automatable, and technical impact is only 'partial' rather than complete. EPSS data and KEV status show no active exploitation in the wild. This is a good example of a privilege-escalation or insider-threat scenario rather than a remote mass-exploitation risk; it is more likely exploitable by datacenter administrators with MCU access or advanced threat actors with network proximity to administrative interfaces. Organizations should prioritize patching in order, but this does not warrant emergency response procedures.

A datacenter administrator with legitimate network access to B300 MCU management interfaces could craft malicious firmware update packages or register modification commands to corrupt the MCU state, triggering repeated system resets and preventing normal accelerator operation (denial of service). Alternatively, a supply-chain attacker or insider with access to B300 provisioning systems could inject registry modifications during deployment to alter performance telemetry or introduce persistent system instability. Attack complexity is high because successful exploitation requires deep knowledge of the CX8 MCU register map, valid authentication credentials, and understanding of the specific unsupported registries that trigger the bad state condition.