NVIDIA Sbios vulnerabilities

6 CVEs affecting NVIDIA Sbios, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25509, published 2023-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-0209, published 2023-04-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service,…
CVE-2023-25509, published 2023-04-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, and escalation of privileges.
CVE-2022-42286, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges.
CVE-2023-25506, published 2023-04-22. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code…
CVE-2022-42285, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to denial of service, escalation of…
CVE-2023-0207, published 2023-04-22. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to…