ZDI-CAN-25682: ZDI-25-144: NVIDIA Riva gRPC API Missing Authentication for Critical Function Authentication Bypass Vulnerability
Published Mar 13, 2025
·Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of NVIDIA Riva. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2025-23243.
Affected Software
1 affected component
Nvidia Riva
Event History
Mar 13, 2025
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-25682?
ZDI-CAN-25682 has a CVSS rating of 6.5, indicating a medium severity level.
2
What does ZDI-CAN-25682 exploit?
ZDI-CAN-25682 allows remote attackers to bypass authentication without requiring any credentials.
3
Which software is affected by ZDI-CAN-25682?
ZDI-CAN-25682 affects installations of NVIDIA Riva.
4
How do I fix ZDI-CAN-25682?
To fix ZDI-CAN-25682, update your installation of NVIDIA Riva to the latest version provided by NVIDIA.
5
Can ZDI-CAN-25682 be exploited remotely?
Yes, ZDI-CAN-25682 can be exploited remotely as it does not require authentication.