ZDI-25-144: NVIDIA Riva gRPC API Missing Authentication for Critical Function Authentication Bypass Vulnerability
Published Mar 13, 2025
·Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of NVIDIA Riva. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2025-23243.
Affected Software
1 affected component
Nvidia Riva
Event History
Mar 13, 2025
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-25-144?
The ZDI-25-144 vulnerability has a CVSS rating of 6.5, indicating a medium severity threat.
2
How does ZDI-25-144 affect NVIDIA Riva installations?
ZDI-25-144 allows remote attackers to bypass authentication on affected installations of NVIDIA Riva.
3
Is authentication required to exploit ZDI-25-144?
No, authentication is not required to exploit the ZDI-25-144 vulnerability.
4
What is the impact of ZDI-25-144 on system security?
The impact of ZDI-25-144 is that it can allow unauthorized access to sensitive system functionalities.
5
How can I mitigate the risk of ZDI-25-144?
To mitigate the risk of ZDI-25-144, it is recommended to apply the security patches provided by NVIDIA for Riva.