NVIDIA ConnectX and BlueField network adapters contain a flaw in a control register that allows a virtual function (VF) user to send a malicious firmware command that bypasses the intended access control. The weakness is an improper access control (CWE‑1262). If successfully exploited, the victim device or its host can become unresponsive, effectively causing a denial of service for any application relying on the adapter.

Affected vendors include NVIDIA. The impacted products are NVIDIA ConnectX GA, LTS23, LTS24, and ConnectX‑5, as well as NVIDIA BlueField GA, LTS23, and LTS24. No specific firmware or driver version information is available in the advisory.

The CVSS score of 6.8 indicates a medium severity vulnerability. EPSS information is not available, so the likelihood of exploitation is uncertain, and the flaw is not listed in CISA’s KEV catalog. The attack would most likely be local, requiring that the attacker already has VF user privileges; a crafted firmware command can trigger a device or host failure.