NVIDIA Dgx a100 Firmware vulnerabilities

28 CVEs affecting NVIDIA Dgx a100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-31035, published 2024-01-12.

More from NVIDIA.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-42279, published 2023-01-13. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and…
• CVE-2022-42290, published 2023-01-13. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and…
• CVE-2022-42289, published 2023-01-13. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and…
• CVE-2022-42273, published 2023-01-12. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
• CVE-2022-42272, published 2023-01-12. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.
• CVE-2023-31024, published 2024-01-12. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful…
• CVE-2023-31029, published 2024-01-12. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted…
• CVE-2023-31030, published 2024-01-12. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit…
• CVE-2023-31025, published 2024-01-12. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.
• CVE-2022-42288, published 2023-01-13. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.

Latest

• CVE-2023-31035, published 2024-01-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this…
• CVE-2023-31034, published 2024-01-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may…
• CVE-2023-31033, published 2024-01-12. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead…
• CVE-2023-31032, published 2024-01-12. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.
• CVE-2023-31031, published 2024-01-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX Station A100 and DGX Station A800 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access. A successful exploit of this vulnerability may lead to…
• CVE-2023-25522, published 2023-07-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in an unexpected format. A successful…