CVE-2020-11488

CVE-2020-11488 affects NVIDIA DGX-1 and DGX-2 systems where the AMI BMC firmware before the stated versions does not validate the RSA-1024 public key used to verify firmware signatures, enabling potential information disclosure or code execution. Public details from NVIDIA/NVD indicate DGX-1 BMC ...

CVE-2020-11489

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure...

CVE-2020-11486

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

CVE-2020-11486

CVE-2020-11486 (NVIDIA DGX BMC): A vulnerability in the AMI Baseboard Management Controller (BMC) firmware on DGX-1 (and related DGX models) allows an attacker to upload or transfer files that can be automatically processed within the product’s environment, potentially enabling remote code execut...

CVE-2020-11487

NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC firmware versions, contains a vulnerability in the AMI BMC firmware in which the use of a hard-coded RSA 1024 key with weak ciphers may le...

CVE-2020-11487

CVE-2020-11487 affects NVIDIA DGX-1, DGX-2, and DGX A100 servers via AMI BMC firmware with a hard-coded RSA 1024 key and weak ciphers, leading to information disclosure over the BMC. Affected firmware is before 3.38.30 (DGX-1), before 1.06.06 (DGX-2), and before 00.13.16 (DGX A100). NVIDIA provid...

CVE-2020-11484

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11483

NVIDIA DGX-1, DGX-2, and DGX A100 DGX systems are affected by CVE-2020-11483 due to hard-coded credentials in the AMI BMC firmware. The root cause is embedded credentials in the BMC firmware, which may permit elevation of privileges or information disclosure over the network. According to NVIDIA’...

CVE-2020-11483

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information...

CVE-2020-11485

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the...

CVE-2020-11485

CVE-2020-11485 affects NVIDIA DGX systems (notably DGX-1) with AMI BMC firmware versions prior to 3.38.30. The vulnerability is a Cross-Site Request Forgery (CSRF) in the BMC web interface, where the application does not sufficiently verify that a request is intentional, potentially enabling info...

CVE-2020-11484

CVE-2020-11484 affects NVIDIA DGX-1 (and DGX-2, DGX A100) with AMI BMC firmware older than 3.38.30. The vulnerability allows an attacker with administrative privileges to obtain the hash of the BMC/IPMI user password, potentially leading to information disclosure. NVIDIA’s security bulletin docum...

CVE-2020-11616: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator PRNG algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information...

CVE-2020-11488: Improper Verification of Cryptographic Signature

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead t...

CVE-2020-11615: Use of Hard-coded Credentials

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure...

CVE-2020-11485: Cross-Site Request Forgery (CSRF)

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the...

Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

NVIDIA has released a firmware security update for NVIDIA DGX™ servers. This update addresses security issues in the AMI Baseboard Management Controller BMC firmware that may lead to remote code execution, elevation of privileges, or information disclosure. All issues require network access to th...

The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules arises from copying buffers without checking the size of the input data. This allows attackers to exploit their privileges.

The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

Experts Warn of Privacy Risks Caused by Link Previews in Messaging Apps

Cybersecurity researchers over the weekend disclosed new security risks associated with link previews in popular messaging apps that cause the services to leak IP addresses, expose links sent via end-to-end encrypted chats, and even unnecessarily download gigabytes of data stealthily in the...

Experts Warn of Privacy Risks Caused by Link Previews in Messaging Apps

Cybersecurity researchers over the weekend disclosed new security risks associated with link previews in popular messaging apps that cause the services to leak IP addresses, expose links sent via end-to-end encrypted chats, and even unnecessarily download gigabytes of data stealthily in the...