CVE-2025-33242
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:HSummary
CVE-2025-33242 is a medium-severity Hardware Internal or Debug Modes Allow Override of Locks (CWE-1234) vulnerability in Custhelp (inferred from references). Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-51 (Hardware-based Protection) and CM-7 (Least Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208971
Vulnerability Data
NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad state. A successful exploit of this vulnerability might lead to denial of service and data tampering.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Hardware-enforced write protection on configuration registers or fuses directly blocks debug-mode bypass of locks.
Restricting debug or maintenance functions to least functionality stops the debug-mode override path from being reachable.
Isolating security functions from non-security functions (including debug logic) structurally prevents lock overrides from debug modes.
Tamper-resistance mechanisms reduce the ability of debug interfaces to alter protected state even if the mode is entered.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardware integrity assessment prior to acquisition directly evaluates secure debug/lock behavior.
Hardened configuration baselines can disable or lock debug modes in production hardware.
Identifying hardware vulnerabilities can surface debug-mode bypass risks before deployment.
Hardware replacement decisions can address devices lacking proper debug-lock protections.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing may detect debug-mode bypasses but does not prevent the underlying hardware weakness.
Restricting privileged utility programs limits debug access, but does not guarantee hardware lock protection.
Privileged access rights can restrict debug-mode overrides but do not specifically address hardware lock bypass.
Secure system architecture and engineering principles can mandate hardware lock enforcement during debug, covering most of the weakness.
Configuration management can enforce secure debug settings, yet hardware-level lock bypass may still occur outside its scope.