CVE-2025-33187

The error classified as CWE-269 (Improper Privilege Management) involves insufficient access control in the SROOT component of the DGX Spark GB10 device. An attacker with privileged access to the system can exploit this vulnerability to go beyond normally permitted privilege scope and gain access to protected areas of the SoC. The local vector (AV:L) indicates that exploitation requires access to the local system, however the scope of the attack extends beyond the component boundary (S:C), which increases the potential impact reach.

Successful exploitation of this vulnerability can lead to arbitrary code execution (RCE), disclosure of sensitive information, data manipulation, denial of service (DoS), or privilege escalation within the protected SoC space.

Patches available from the manufacturer should be applied according to the references – detailed information about patches has been published by NVIDIA at https://nvidia.custhelp.com/app/answers/detail/a_id/5720

NVIDIA DGX Spark GB10 – NVIDIA DGX Spark products and NVIDIA DGX OS; specific versions indicated in the manufacturer's references (https://nvidia.custhelp.com/app/answers/detail/a_id/5720)