CVE-2021-23201

NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to generate valid microcode by identifying, exploiting, and loading vulnerable microcode. Such an attack could lead to information disclosure, data corruption, or denial of service of the device. The scope may extend to other components.

Published: 2021-11-20 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2021-23201 is rated Low Risk (36.8/100): CVSS High severity, with low exploitation likelihood (EPSS 0.27%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2021-23201

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.11% 0.27% +0.16%
2 2026-05-18 0.04% 0.11% +0.07%
3 2023-03-07 — 0.04% —

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2021-23201

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H)
They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 0.8 6.0 [email protected]
7.5 3.1 HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H)
They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 0.8 6.0 [email protected]
6.9 2.0 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 3.4 10.0 [email protected]

Weakness enumeration for CVE-2021-23201

Affected software / configurations for CVE-2021-23201

Vendor Product Version Raw CPE
nvidia geforce_gtx_950 — cpe:2.3:h:nvidia:geforce_gtx_950:-:*:*:*:*:*:*:*
nvidia geforce_gtx_960 — cpe:2.3:h:nvidia:geforce_gtx_960:-:*:*:*:*:*:*:*
nvidia geforce_gtx_970 — cpe:2.3:h:nvidia:geforce_gtx_970:-:*:*:*:*:*:*:*
nvidia geforce_gtx_980 — cpe:2.3:h:nvidia:geforce_gtx_980:-:*:*:*:*:*:*:*
nvidia geforce_gtx_titan_x — cpe:2.3:h:nvidia:geforce_gtx_titan_x:-:*:*:*:*:*:*:*
nvidia jetson_nano — cpe:2.3:h:nvidia:jetson_nano:-:*:*:*:*:*:*:*
nvidia jetson_nano — cpe:2.3:h:nvidia:jetson_nano:-:*:-:*:*:*:*:*
nvidia jetson_nano — cpe:2.3:h:nvidia:jetson_nano:-:*:developer_kit:*:*:*:*:*
nvidia jetson_tx1 — cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*
nvidia quadro_m1000m — cpe:2.3:h:nvidia:quadro_m1000m:-:*:*:*:*:*:*:*
nvidia quadro_m1200 — cpe:2.3:h:nvidia:quadro_m1200:-:*:*:*:*:*:*:*
nvidia quadro_m2000 — cpe:2.3:h:nvidia:quadro_m2000:-:*:*:*:*:*:*:*
nvidia quadro_m2000m — cpe:2.3:h:nvidia:quadro_m2000m:-:*:*:*:*:*:*:*
nvidia quadro_m2200 — cpe:2.3:h:nvidia:quadro_m2200:-:*:*:*:*:*:*:*
nvidia quadro_m3000m — cpe:2.3:h:nvidia:quadro_m3000m:-:*:*:*:*:*:*:*
nvidia quadro_m4000 — cpe:2.3:h:nvidia:quadro_m4000:-:*:*:*:*:*:*:*
nvidia quadro_m4000m — cpe:2.3:h:nvidia:quadro_m4000m:-:*:*:*:*:*:*:*
nvidia quadro_m5000 — cpe:2.3:h:nvidia:quadro_m5000:-:*:*:*:*:*:*:*
nvidia quadro_m5000m — cpe:2.3:h:nvidia:quadro_m5000m:-:*:*:*:*:*:*:*
nvidia quadro_m500m — cpe:2.3:h:nvidia:quadro_m500m:-:*:*:*:*:*:*:*
nvidia quadro_m520 — cpe:2.3:h:nvidia:quadro_m520:-:*:*:*:*:*:*:*
nvidia quadro_m5500 — cpe:2.3:h:nvidia:quadro_m5500:-:*:*:*:*:*:*:*
nvidia quadro_m6000 — cpe:2.3:h:nvidia:quadro_m6000:-:*:*:*:*:*:*:*
nvidia quadro_m600m — cpe:2.3:h:nvidia:quadro_m600m:-:*:*:*:*:*:*:*
nvidia quadro_m620 — cpe:2.3:h:nvidia:quadro_m620:-:*:*:*:*:*:*:*
nvidia shield_tv — cpe:2.3:h:nvidia:shield_tv:-:*:*:*:*:*:*:*
nvidia shield_tv_pro — cpe:2.3:h:nvidia:shield_tv_pro:-:*:*:*:*:*:*:*
nvidia tesla_m10 — cpe:2.3:h:nvidia:tesla_m10:-:*:*:*:*:*:*:*
nvidia tesla_m2050 — cpe:2.3:h:nvidia:tesla_m2050:-:*:*:*:*:*:*:*
nvidia tesla_m2070 — cpe:2.3:h:nvidia:tesla_m2070:-:*:*:*:*:*:*:*
nvidia tesla_m2070q — cpe:2.3:h:nvidia:tesla_m2070q:-:*:*:*:*:*:*:*
nvidia tesla_m2090 — cpe:2.3:h:nvidia:tesla_m2090:-:*:*:*:*:*:*:*
nvidia tesla_m4 — cpe:2.3:h:nvidia:tesla_m4:-:*:*:*:*:*:*:*
nvidia tesla_m40 — cpe:2.3:h:nvidia:tesla_m40:-:*:*:*:*:*:*:*
nvidia tesla_m6 — cpe:2.3:h:nvidia:tesla_m6:-:*:*:*:*:*:*:*
nvidia tesla_m60 — cpe:2.3:h:nvidia:tesla_m60:-:*:*:*:*:*:*:*
nvidia tesla_p100 — cpe:2.3:h:nvidia:tesla_p100:-:*:*:*:*:*:*:*

References for CVE-2021-23201

cvelogic Threat Intelligence