Vulnerability in SROOT Firmware of NVIDIA DGX Spark GB10
CVE-2025-33193

5.7MEDIUM

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33193?

The NVIDIA DGX Spark GB10 is susceptible to a vulnerability in its SROOT firmware, which involves improper validation of integrity. An attacker exploiting this flaw could potentially lead to unauthorized access to sensitive information, posing a significant risk to the confidentiality of data processed by affected systems. Vigilant monitoring and timely updates are essential to mitigate the potential impacts associated with this security issue.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33193
https://www.cve.org/CVERecord?id=CVE-2025-33193
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.