NVIDIA Bmc vulnerabilities

13 CVEs affecting NVIDIA Bmc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25508, published 2023-04-22.

More from NVIDIA.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-25507, published 2023-04-22. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution,…
• CVE-2022-42278, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to…
• CVE-2022-42282, published 2023-01-13. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure.
• CVE-2022-42280, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication bypass.
• CVE-2022-42274, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
• CVE-2023-25508, published 2023-04-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which…
• CVE-2022-42287, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation…
• CVE-2023-25505, published 2023-04-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to…
• CVE-2022-42283, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
• CVE-2023-0201, published 2023-04-22. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of…

Latest

• CVE-2023-0200, published 2023-04-22. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of…
• CVE-2022-42284, published 2023-01-13. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure.