The Hard-Coded Backdoor: Critical 9.8 Severity NVIDIA Flaws Grant Total Control of AI Systems

NVIDIA has issued an urgent security update for its Isaac Launchable software, patching three critical vulnerabilities that could allow attackers to seize total control of affected systems. The flaws, CVE-2025-33222, CVE-2025-33223 and CVE-2025-33224, carry a near-maximum CVSS score of 9.8 and affect all versions prior to the newly released version 1.1.

The most serious CVE-2025-33222 involves hard-coded credentials that could bypass authentication entirely, while CVE-2025-33223 and CVE-2025-33224 stem from improper privilege management and could enable executions with unnecessary privileges. According to the bulletin, these issues could lead to code execution, escalation of privileges, denial of service and data tampering, effectively allowing an attacker to walk through the front door and alter critical data. NVIDIA urges users to upgrade to version 1.1 immediately to close the security gaps and protect Isaac Launchable across all platforms.