NVIDIA Dgx h100 Firmware vulnerabilities

15 CVEs affecting NVIDIA Dgx h100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-31015, published 2023-09-20.

More from NVIDIA.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-25528, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted…
• CVE-2023-25530, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial…
• CVE-2023-25533, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to information disclosure, code…
• CVE-2023-31009, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial…
• CVE-2023-31010, published 2023-09-20. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges,…
• CVE-2023-31013, published 2023-09-20. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of…
• CVE-2023-31012, published 2023-09-20. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges…
• CVE-2023-25529, published 2023-09-20. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing…
• CVE-2023-31011, published 2023-09-20. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges…
• CVE-2023-25534, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service,…

Latest

• CVE-2023-31015, published 2023-09-20. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vulnerability may lead to escalation of…
• CVE-2023-31008, published 2023-09-20. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of services,…
• CVE-2023-25532, published 2023-09-20. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerability may lead to information disclosure.