NVIDIA has released a critical security update addressing a significant vulnerability in its Unified Fabric Manager (UFM) products.
This flaw, identified as CVE-2024-0130, poses a high-severity risk to users, with a CVSS v3.1 base score of 8.8.
The vulnerability could allow attackers to escalate privileges, tamper with data, and even compromise system availability.
Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.
The vulnerability affects multiple NVIDIA UFM products, including UFM Enterprise, UFM Appliance, and UFM CyberAI.
It arises due to improper authentication (CWE-287) when processing malformed requests via the Ethernet management interface.
Exploiting this flaw does not require prior authentication, nor user interaction, making it a highly exploitable issue.
If leveraged successfully, this vulnerability could lead to:
NVIDIA cautions users to evaluate the risk specific to their configurations, as the exploitability depends on how the Ethernet management interface is deployed.
Affected Products and Security Updates
NVIDIA has provided security patches for affected products across various operating systems. Users should promptly apply these updates to mitigate risks.
Product | Affected Versions | Updated Version |
UFM Enterprise GA | 6.15.x, 6.16.x, 6.17.x | 6.18.0-5 |
UFM Appliance GA | 1.6.x, 1.7.x, 1.8.x | 1.9.1-2 |
UFM CyberAI GA | 2.6.x, 2.7.x, 2.8.x | 2.9.1-2 |
UFM SDN Appliance GA | 4.14.x, 4.15.x, 4.16.x | 4.17.0.5 |
The vulnerability primarily impacts Ethernet management interfaces, which are often isolated from public networks, reducing their exposure. Additionally, LTS22 versions of UFM products remain unaffected.
Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar
Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on…
Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI)…
A critical security vulnerability has been discovered in Netwrix Password Secure, a widely used enterprise…
Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in…
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate…
A sophisticated social engineering campaign that leverages the viral power of TikTok to distribute dangerous…