CVE-2023-25507

HIGH

NVIDIA DGX-1 BMC < 3.39.30 - Authenticated OS Command Injection via SPX REST API

Title source: llm
STIX 2.1

Description

NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering.

References (1)

Core 1

Scores

CVSS v3 7.2
EPSS 0.0109
EPSS Percentile 78.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
nvidia/bmc < 3.39.30
Published Apr 22, 2023
Tracked Since Feb 18, 2026