NVIDIA Dgx OS vulnerabilities

15 CVEs affecting NVIDIA Dgx OS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24218, published 2026-05-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-24218, published 2026-05-20. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of…
CVE-2025-33189, published 2025-11-25. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. A successful exploit of this vulnerability might lead to code execution, data…
CVE-2025-33187, published 2025-11-25. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas. A successful exploit of this vulnerability might lead to…
CVE-2025-33197, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
CVE-2025-33191, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. A successful exploit of this vulnerability might lead to denial of service.
CVE-2025-33190, published 2025-11-25. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A successful exploit of this vulnerability might lead to code execution, data…
CVE-2025-33188, published 2025-11-25. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful exploit of this vulnerability might lead to information…
CVE-2025-33194, published 2025-11-25. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. A successful exploit of this vulnerability might lead to information…
CVE-2025-33195, published 2025-11-25. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause unexpected memory buffer operations. A successful exploit of this vulnerability might lead to data…
CVE-2025-33192, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read. A successful exploit of this vulnerability might lead to denial of service.

Latest

CVE-2025-33200, published 2025-11-25. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information…
CVE-2025-33199, published 2025-11-25. Low severity, CVSS 3.8. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this vulnerability might lead to data…
CVE-2025-33198, published 2025-11-25. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information…
CVE-2025-33196, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information…
CVE-2025-33193, published 2025-11-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper validation of integrity. A successful exploit of this vulnerability might lead to information…