NVIDIA has released a critical security update addressing a significant vulnerability in its Unified Fabric Manager (UFM) products.
This flaw, identified as CVE-2024-0130, poses a high-severity risk to users, with a CVSS v3.1 base score of 8.8.
The vulnerability could allow attackers to escalate privileges, tamper with data, and even compromise system availability.
Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.
The vulnerability affects multiple NVIDIA UFM products, including UFM Enterprise, UFM Appliance, and UFM CyberAI.
It arises due to improper authentication (CWE-287) when processing malformed requests via the Ethernet management interface.
Exploiting this flaw does not require prior authentication, nor user interaction, making it a highly exploitable issue.
If leveraged successfully, this vulnerability could lead to:
NVIDIA cautions users to evaluate the risk specific to their configurations, as the exploitability depends on how the Ethernet management interface is deployed.
Affected Products and Security Updates
NVIDIA has provided security patches for affected products across various operating systems. Users should promptly apply these updates to mitigate risks.
Product | Affected Versions | Updated Version |
UFM Enterprise GA | 6.15.x, 6.16.x, 6.17.x | 6.18.0-5 |
UFM Appliance GA | 1.6.x, 1.7.x, 1.8.x | 1.9.1-2 |
UFM CyberAI GA | 2.6.x, 2.7.x, 2.8.x | 2.9.1-2 |
UFM SDN Appliance GA | 4.14.x, 4.15.x, 4.16.x | 4.17.0.5 |
The vulnerability primarily impacts Ethernet management interfaces, which are often isolated from public networks, reducing their exposure. Additionally, LTS22 versions of UFM products remain unaffected.
Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar
Leading cryptocurrency exchange Kraken has disclosed that it recently thwarted an infiltration attempt by a…
Security researchers have uncovered a series of critical vulnerabilities in the Tenda RX2 Pro Dual-Band…
Cybersecurity researchers are raising alarms as hackers increasingly weaponize email input fields to execute cross-site scripting…
A recent investigation by cybersecurity firm EclecticIQ, in collaboration with threat hunters, has exposed a…
Cybersecurity researchers have uncovered a dangerous new exploitation technique, dubbed the "SonicBoom Attack Chain," which…
A researcher has unveiled a novel integration between AI-powered Copilot and Microsoft's WinDbg, dramatically simplifying…