Out-of-bounds write in ConnectX Firmware and BlueField - CVE-2025-23299

Vulnerability identifier: #VU120620

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-23299

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the management interface. A local privileged user can trigger an out-of-bounds write and execute arbitrary code on the target system.

ConnectX Firmware
BlueField
ThinkEdge SE450
ThinkAgile VX7375-N Integrated System
ThinkAgile VX7520
ThinkAgile VX7520 N
ThinkAgile VX7530 Appliance
ThinkAgile VX7531 Certified Node
ThinkAgile VX7575 Integrated System
ThinkAgile VX7820
ThinkAgile VX850 V3 Certified Node
ThinkAgile VX850 V3 SAP HANA Certified Node
ThinkAgile VX850 V3 SAP HANA DPU Certified Node
Thinkagile VX7330 Appliance
ThinkEdge SE455 V3
ThinkServer SR860P
ThinkStation P3 Ultra SFF Gen 2 Workstation
ThinkSystem SD530
ThinkSystem SD630 V2
ThinkSystem SD650 DWC Dual Node Tray
ThinkSystem SD650 V2
ThinkSystem SD650 V3
ThinkSystem SD650-N V2
ThinkAgile VX650 V3 DPU Certified Node
ThinkAgile VX5530 Appliance
ThinkAgile VX630 V3 Certified Node
ThinkAgile VX630 V3 Integrated System
ThinkAgile VX635 V3 Certified Node
ThinkAgile VX635 V3 Integrated System
ThinkAgile VX645 V3 Certified Node
ThinkAgile VX645 V3 Integrated System
ThinkAgile VX650 V2 DPU Certified Node
ThinkAgile VX650 V3 Certified Node
ThinkSystem SD665 V3
ThinkAgile VX650 V3 DPU Integrated System
ThinkAgile VX650 V3 DPU SAP HANA Certified Node
ThinkAgile VX650 V3 Integrated System
ThinkAgile VX650 V3 SAP HANA Certified Node
ThinkAgile VX655 V3 Certified Node
ThinkAgile VX655 V3 Integrated System
ThinkAgile VX665 V3 Certified Node
ThinkAgile VX665 V3 Integrated System
ThinkAgile VX7320 N
ThinkSystem SR860 V2
ThinkSystem SR670
ThinkSystem SR670 V2
ThinkSystem SR675 V3
ThinkSystem SR680a V3
ThinkSystem SR850
ThinkSystem SR850 V2
ThinkSystem SR850 V3
ThinkSystem SR850P
ThinkSystem SR860
ThinkSystem SR665 V3
ThinkSystem SR860 V3
ThinkSystem SR950
ThinkSystem SR950 V3
ThinkSystem ST550
ThinkSystem ST558
ThinkSystem ST650 V2
ThinkSystem ST650 V3
ThinkSystem ST658 V2
ThinkSystem ST658 V3
ThinkSystem SR635
ThinkSystem SE350
ThinkSystem SN550
ThinkSystem SN550 V2
ThinkSystem SN850
ThinkSystem SR250
ThinkSystem SR258
ThinkSystem SR630
ThinkSystem SR630 V2
ThinkSystem SR630 V3
Flex Compute Node - x240 M5
ThinkSystem SR635 V3
ThinkSystem SR645
ThinkSystem SR645 V3
ThinkSystem SR650
ThinkSystem SR650 V2
ThinkSystem SR650 V3
ThinkSystem SR655
ThinkSystem SR655 V3
ThinkSystem SR665
ThinkAgile HX5520-C Appliance
ThinkAgile HX3320 Appliance
ThinkAgile HX3321 Certified Node
ThinkAgile HX3330 Appliance
ThinkAgile HX3331 Certified Node
ThinkAgile HX3520-G Appliance
ThinkAgile HX3521-G Certified Node
ThinkAgile HX3720 Appliance
ThinkAgile HX3721 Certified Node
ThinkAgile HX5520 Appliance
ThinkAgile HX2720-E Appliance
ThinkAgile HX5521 Certified Node
ThinkAgile HX5521-C Certified Node
ThinkAgile HX5531 Certified Node
ThinkAgile HX630 V3 Certified Node
ThinkAgile HX630 V3 Integrated System
ThinkAgile HX650 V3 Certified Node
ThinkAgile HX650 V3 Integrated System
ThinkAgile HX7520 Appliance
ThinkAgile HX7521 Certified Node
ThinkAgile HX1321 Certified Node
WEKA
System x3550 M5
System x3650 M5
System x3850 X6
System x3950 X6
ThinkAgile HX5530 Appliance
ThinkAgile HX7530 Appliance
ThinkAgile VX3331 Certified Node
ThinkAgile HX1320 Appliance
ThinkAgile VX3720
ThinkAgile HX1330 Appliance
ThinkAgile HX1331 Certified Node
ThinkAgile HX1520-R Appliance
ThinkAgile HX1521-R Certified Node
ThinkAgile HX2320 Appliance
ThinkAgile HX2320-E Appliance
ThinkAgile HX2321 Certified Node
ThinkAgile HX2330 Appliance
ThinkAgile HX2331 Certified Node
ThinkAgile VX2330 Appliance
ThinkAgile MX Certified Node – Hybrid
ThinkAgile MX1021 on SE350
ThinkAgile VX 1SE Certified Node
ThinkAgile VX 1U Certified Node
ThinkAgile VX 2U Certified Node
ThinkAgile VX 2U4N Certified Node
ThinkAgile VX 4U Certified Node
ThinkAgile VX1320
ThinkAgile VX2320
ThinkAgile HX7820 Appliance
ThinkAgile VX2375 Integrated System
ThinkAgile VX3320
ThinkAgile VX3330 Appliance
ThinkAgile VX3375 Integrated System
ThinkAgile VX3376 Certified Node
ThinkAgile VX3520-G
ThinkAgile VX3530-G Appliance
ThinkAgile VX3575-G Integrated System
ThinkAgile VX5520
ThinkAgile MX650 v3 Integrated System
ThinkAgile HX7531 Certified Node
ThinkAgile HX7821 Certified Node
ThinkAgile MX Edge Appliance - MX1020
ThinkAgile MX3330-F All-flash Appliance
ThinkAgile MX3330-H Hybrid Appliance
ThinkAgile MX3331-F All-flash Certified node
ThinkAgile MX3331-H Hybrid Certified node
ThinkAgile MX3520 F Appliance - All flash
ThinkAgile MX3520 H Appliance - Hybrid
ThinkAgile MX3530 F All flash Appliance
ThinkAgile MX3530-H Hybrid Appliance
ThinkAgile MX3531 H Hybrid Certified node
ThinkAgile MX3531-F All-flash Certified node
ThinkAgile MX455 V3 Integrated System
ThinkAgile MX455 V3 Premier System
ThinkAgile MX630 V3 Certified Node
ThinkAgile MX630 V3 Integrated System
ThinkAgile MX650 V3 Certified Node
ThinkAgile MX Certified Node – All Flash
IBM i
Nvidia-Mellanox ConnectX Networking Adapter/Device Linux Firmware
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Firmware
Nvidia-Mellanox ConnectX Networking Adapter/Device Firmware
NVIDIA ConnectX-6 25G 2-Ports Firmware Package for Windows 11 (64-bit) - ThinkStation P3 Ultra SFF Gen 2

Install updates from vendor's website.

ConnectX Firmware - addressed in versions 32.1908, 35.4554, 39.5050, 43.3608, 46.1006
BlueField - addressed in versions 35.4554, 39.5050, 43.3608, 46.1006
Nvidia-Mellanox ConnectX Networking Adapter/Device Linux Firmware - update to CX-DOCA-3.1.0-2
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Firmware - update to CX-DOCA-3.1.0-2-A
Nvidia-Mellanox ConnectX Networking Adapter/Device Firmware - update to XX.46.3048
NVIDIA ConnectX-6 25G 2-Ports Firmware Package for Windows 11 (64-bit) - ThinkStation P3 Ultra SFF Gen 2 - update to 22.46.3048

• https://nvidia.custhelp.com/app/answers/detail/a_id/5684

• Privilege escalation in NVIDIA Bluefield and ConnectX
• Lenovo update for NVIDIA networking
• IBM i update for NVIDIA Bluefield and ConnectX