This vulnerability (CVE-2025-33207) affects NVIDIA ConnectX and BlueField GA products. It arises from improper access control in a control register interface, where a user possessing VF access can send malicious commands to the firmware. The flaw is classified under CWE-1262. Exploitation can lead to denial of service conditions. The CVSS 3.1 base score is 6.8, reflecting a medium severity with attack vector as adjacent network, low attack complexity, low privileges required, no user interaction, and scope changed. No known exploits in the wild or patch information is provided.

An attacker with VF access can cause denial of service by exploiting improper access control in the register interface. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability does not appear to allow privilege escalation or data compromise but can disrupt service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict VF access to trusted users and monitor for unusual firmware commands if possible.