HGX / DGX GB200, GB300, B300 (BMC -> HMC): BMC admin can pivot to the HMC as administrator

CVSS 6.7CVE-2025-23337NVIDIA / GPU stackcurated

Impact

BMC admin can pivot to the HMC as administrator -> code execution and privesc on the GPU baseboard controller

Who can reach it

Operator or attacker holding BMC admin on the mgmt network

What to do

Flash BMC + HMC firmware out-of-band; treat BMC admin as a tier-0 credential and rotate

References

https://github.com/NVIDIA/product-security/tree/main/2025/5692 https://nvd.nist.gov/vuln/detail/CVE-2025-23337

Related entries

NVIDIA Nsight Graphics (ngfx component, Windows): An ngfx component resolves a DLL from an untrusted search path, soCVE-2025-23355 · NVIDIA Nsight Graphics (ngfx component, Windows)Medium
NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmware: A second out-of-bounds write in SROOT firmwareCVE-2025-33190 · NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmwareMedium
CUDA Toolkit: Code exec via path manipulation on library loadCVE-2025-33231 · CUDA ToolkitMedium
NVIDIA GPU driver: out-of-bounds writes in the kernel mode layer reachable by a privileged local userCVE-2026-47509 · NVIDIA GPU Display Driver kernel mode layer (out-of-bounds writes)Medium
NVIDIA GPU driver: unbounded string operation in the kernel mode layer causes an out-of-bounds readCVE-2026-47515 · NVIDIA GPU Display Driver kernel mode layer (unbounded string operation)Medium
NVIDIA GPU driver: improper input validation in the kernel mode layerCVE-2026-47522 · NVIDIA GPU Display Driver kernel mode layer (input validation)Medium

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.