Cyber Security News

NVIDIA UFM Vulnerability Leads to Privilege Escalation & Data Tampering

NVIDIA has released a critical security update addressing a significant vulnerability in its Unified Fabric Manager (UFM) products.

This flaw, identified as CVE-2024-0130, poses a high-severity risk to users, with a CVSS v3.1 base score of 8.8.

The vulnerability could allow attackers to escalate privileges, tamper with data, and even compromise system availability.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

NVIDIA UFM Vulnerability – CVE-2024-0130

The vulnerability affects multiple NVIDIA UFM products, including UFM Enterprise, UFM Appliance, and UFM CyberAI.

It arises due to improper authentication (CWE-287) when processing malformed requests via the Ethernet management interface.

Exploiting this flaw does not require prior authentication, nor user interaction, making it a highly exploitable issue.

If leveraged successfully, this vulnerability could lead to:

  • Privilege Escalation – Granting unauthorized users escalated access levels.
  • Data Tampering – Allowing attackers to alter sensitive information.
  • Denial of Service (DoS) – Disrupting system functionality.
  • Information Disclosure – Exposing confidential system data.

NVIDIA cautions users to evaluate the risk specific to their configurations, as the exploitability depends on how the Ethernet management interface is deployed.

Affected Products and Security Updates

NVIDIA has provided security patches for affected products across various operating systems. Users should promptly apply these updates to mitigate risks.

ProductAffected VersionsUpdated Version
UFM Enterprise GA6.15.x, 6.16.x, 6.17.x6.18.0-5
UFM Appliance GA1.6.x, 1.7.x, 1.8.x1.9.1-2
UFM CyberAI GA2.6.x, 2.7.x, 2.8.x2.9.1-2
UFM SDN Appliance GA4.14.x, 4.15.x, 4.16.x4.17.0.5

The vulnerability primarily impacts Ethernet management interfaces, which are often isolated from public networks, reducing their exposure. Additionally, LTS22 versions of UFM products remain unaffected.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

North Korean Hacker Tries to Infiltrate Kraken Through Job Application

Leading cryptocurrency exchange Kraken has disclosed that it recently thwarted an infiltration attempt by a…

44 minutes ago

Multiple Flaws in Tenda RX2 Pro Let Attackers Gain Admin Access

Security researchers have uncovered a series of critical vulnerabilities in the Tenda RX2 Pro Dual-Band…

1 hour ago

Hackers Exploit Email Fields to Launch XSS and SSRF Attacks

Cybersecurity researchers are raising alarms as hackers increasingly weaponize email input fields to execute cross-site scripting…

3 hours ago

Luna Moth Hackers Use Fake Helpdesk Domains to Target Victims

A recent investigation by cybersecurity firm EclecticIQ, in collaboration with threat hunters, has exposed a…

4 hours ago

SonicBoom Attack Chain Lets Hackers Bypass Login and Gain Admin Control

Cybersecurity researchers have uncovered a dangerous new exploitation technique, dubbed the "SonicBoom Attack Chain," which…

5 hours ago

Researcher Uses Copilot with WinDbg to Simplify Windows Crash Dump Analysis

A researcher has unveiled a novel integration between AI-powered Copilot and Microsoft's WinDbg, dramatically simplifying…

5 hours ago