NVIDIA UFM Vulnerability Leads to Privilege Escalation & Data Tampering

NVIDIA has released a critical security update addressing a significant vulnerability in its Unified Fabric Manager (UFM) products.

This flaw, identified as CVE-2024-0130, poses a high-severity risk to users, with a CVSS v3.1 base score of 8.8.

The vulnerability could allow attackers to escalate privileges, tamper with data, and even compromise system availability.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

NVIDIA UFM Vulnerability – CVE-2024-0130

The vulnerability affects multiple NVIDIA UFM products, including UFM Enterprise, UFM Appliance, and UFM CyberAI.

It arises due to improper authentication (CWE-287) when processing malformed requests via the Ethernet management interface.

Exploiting this flaw does not require prior authentication, nor user interaction, making it a highly exploitable issue.

If leveraged successfully, this vulnerability could lead to:

• Privilege Escalation – Granting unauthorized users escalated access levels.
• Data Tampering – Allowing attackers to alter sensitive information.
• Denial of Service (DoS) – Disrupting system functionality.
• Information Disclosure – Exposing confidential system data.

NVIDIA cautions users to evaluate the risk specific to their configurations, as the exploitability depends on how the Ethernet management interface is deployed.

Affected Products and Security Updates

NVIDIA has provided security patches for affected products across various operating systems. Users should promptly apply these updates to mitigate risks.

Product	Affected Versions	Updated Version
UFM Enterprise GA	6.15.x, 6.16.x, 6.17.x	6.18.0-5
UFM Appliance GA	1.6.x, 1.7.x, 1.8.x	1.9.1-2
UFM CyberAI GA	2.6.x, 2.7.x, 2.8.x	2.9.1-2
UFM SDN Appliance GA	4.14.x, 4.15.x, 4.16.x	4.17.0.5

The vulnerability primarily impacts Ethernet management interfaces, which are often isolated from public networks, reducing their exposure. Additionally, LTS22 versions of UFM products remain unaffected.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar