PT-2025-10897 · Nvidia · Nvidia Riva

Alfredo Oliveira + 1 · Publicado 2025-03-11 · Atualizado 2025-05-03 · CVE-2025-23242

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA Riva versions up to and including 2.18.0

Description The issue is related to improper access control, which could lead to escalation of privileges, data tampering, denial of service, or information disclosure. A successful exploit of this vulnerability might have significant consequences. The estimated number of potentially affected devices worldwide is not specified. There are reports of real-world incidents where this issue was exploited.

Recommendations For versions up to and including 2.18.0, update to a newer version that addresses the improper access control issue to prevent potential data tampering and escalation risks. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2025-04956

CVE-2025-23242

ZDI-25-145

Produtos afetados

Nvidia Riva

Referências · 26

• https://reddit.com/r/pwnhub/comments/1jdgnok/nvidia_fixes_vulnerabilities_that_could_let · Publicação no Reddit
• https://twitter.com/threatsbank/status/1917218242826809594 · Publicação no Twitter
• https://zerodayinitiative.com/advisories/ZDI-25-145 · Nota de Segurança
• https://twitter.com/syedaquib77/status/1917295825992179845 · Publicação no Twitter
• https://twitter.com/grok/status/1902160735817625809 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1918119199307690372 · Publicação no Twitter
• https://nvidia.custhelp.com/app/answers/detail/a_id/5625 · Aviso do Fabricante
• https://twitter.com/cybercronai/status/1900188985042809109 · Publicação no Twitter
• https://t.me/malwr/9490 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1899548502402933016 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-23242 · Nota de Segurança
• https://twitter.com/transilienceai/status/1904864419282075958 · Publicação no Twitter
• https://twitter.com/syedaquib77/status/1918706333949276559 · Publicação no Twitter
• https://twitter.com/gossy_84/status/1917179645457289572 · Publicação no Twitter
• https://twitter.com/SystemTek_UK/status/1900468885784076551 · Publicação no Twitter