CVE-2025-23292 - Vulnerability Details - OpenCVE

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component).

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nvidia	License System

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-23292
https://nvidia.custhelp.com/app/answers/detail/a_id/5705
https://www.cve.org/CVERecord?id=CVE-2025-23292

History

Thu, 02 Oct 2025 09:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nvidia Nvidia license System
Vendors & Products		Nvidia Nvidia license System

Tue, 30 Sep 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Sep 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component).
Weaknesses		CWE-943
References		https://nvd.nist.gov/vuln/detail/CVE-2025-23292 https://nvidia.custhelp.com/app/answers/detail/a_id/5705 https://www.cve.org/CVERecord?id=CVE-2025-23292
Metrics		cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2025-09-30T17:55:02.678Z

Updated: 2025-09-30T20:33:31.040Z

Reserved: 2025-01-14T01:06:26.349Z

Link: CVE-2025-23292

Vulnrichment

Updated: 2025-09-30T18:32:05.081Z

NVD

Status : Awaiting Analysis

Published: 2025-09-30T18:15:49.457

Modified: 2025-10-02T19:12:17.160

Link: CVE-2025-23292

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23292", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2025-01-14T01:06:26.349Z", "datePublished": "2025-09-30T17:55:02.678Z", "dateUpdated": "2025-09-30T20:33:31.040Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["All"], "product": "DLS component of NVIDIA License System", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to v3.5.1 and v3.1.7"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": true, "type": "text/html", "value": "NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component)."}], "value": "NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component)."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "description": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-30T17:55:02.678Z"}, "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23292"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23292"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5705"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T18:32:00.671193Z", "id": "CVE-2025-23292", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T20:33:31.040Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23292", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T18:32:00.671193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T18:32:05.081Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "DLS component of NVIDIA License System", "versions": [{"status": "affected", "version": "All versions prior to v3.5.1 and v3.1.7"}], "platforms": ["All"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23292"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23292"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5705"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component).", "supportingMedia": [{"type": "text/html", "value": "NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component).", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-30T17:55:02.678Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23292", "state": "PUBLISHED", "dateUpdated": "2025-09-30T20:33:31.040Z", "dateReserved": "2025-01-14T01:06:26.349Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2025-09-30T17:55:02.678Z", "assignerShortName": "nvidia"}, "dataVersion": "5.1"}