CVE-2025-33222
Published: 23 December 2025
Summary
CVE-2025-33222 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Nvidia Isaac Launchable. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Authenticator Management prohibits hard-coded credentials and enforces proper establishment and management of authenticators, directly preventing exploitation of CVE-2025-33222.
Flaw Remediation requires timely identification, reporting, and correction of the hard-coded credential flaw in NVIDIA Isaac Launchable via patches or updates.
Account Management allows for the creation, review, modification, disabling, or removal of accounts tied to hard-coded credentials, limiting unauthorized access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded credentials enable use of default/valid accounts (T1078.001) for remote unauthenticated initial access via public-facing application exploitation (T1190), leading directly to arbitrary code execution and privilege escalation (T1068).
NVD Description
NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering.
Deeper analysisAI
CVE-2025-33222 is a critical vulnerability in NVIDIA Isaac Launchable stemming from a hard-coded credential issue, classified under CWE-798 (Use of Hard-coded Credentials). Published on 2025-12-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low attack complexity, and lack of prerequisites for exploitation.
The vulnerability enables remote attackers with no required privileges or user interaction to exploit the hard-coded credentials in NVIDIA Isaac Launchable. Successful exploitation could result in arbitrary code execution, privilege escalation, denial of service, and data tampering, potentially compromising the affected system's confidentiality, integrity, and availability.
Mitigation details are available in official advisories, including NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5749, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33222, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33222. Security practitioners should consult these sources for patch availability, workarounds, and updated guidance.
Details
- CWE(s)