CVE-2025-23243
Published: 11 March 2025
Summary
CVE-2025-23243 is a medium-severity Improper Access Control (CWE-284) vulnerability in Nvidia Riva. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2025-23243 is an improper access control vulnerability (CWE-284) in NVIDIA Riva, published on 2025-03-11. The issue allows a user to potentially cause data tampering or denial of service upon successful exploitation. It has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), rated as medium severity with network accessibility, low attack complexity, no privileges or user interaction required, and unchanged scope.
An unauthenticated attacker with network access can exploit this vulnerability remotely. Exploitation requires low complexity and no user interaction, potentially leading to limited integrity impacts such as data tampering or limited availability impacts resulting in denial of service, with no confidentiality impacts.
The NVIDIA security advisory provides details on mitigation and patches at https://nvidia.custhelp.com/app/answers/detail/a_id/5625.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7626
Vulnerability details
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable improper access control vulnerability in the network-accessible NVIDIA Riva service, allowing unauthenticated attackers to cause data tampering or denial of service with no privileges or user interaction required, directly mapping to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to system resources, addressing the improper access control vulnerability that enables data tampering or denial of service in NVIDIA Riva.
Monitors and controls communications at external interfaces, mitigating remote unauthenticated network access required to exploit the vulnerability.
Employs least privilege to restrict unauthorized actions by attackers exploiting the improper access control, limiting potential data tampering and DoS impacts.