Vulnerability in SROOT Firmware for NVIDIA DGX Spark GB10
CVE-2025-33192

5.7MEDIUM

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33192?

The SROOT firmware in NVIDIA DGX Spark GB10 has a vulnerability that allows an attacker to exploit arbitrary memory reads. If successfully exploited, this issue may lead to significant disruption of service, affecting the operational integrity of systems relying on this product.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33192
https://www.cve.org/CVERecord?id=CVE-2025-33192
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.