CVE-2024-0130 - Vulnerability Details - OpenCVE

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://nvidia.custhelp.com/app/answers/detail/a_id/5584

History

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00126}`	epss `{'score': 0.00109}`

Tue, 10 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 06 Dec 2024 20:00:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.
Weaknesses		CWE-287
References		https://nvidia.custhelp.com/app/answers/detail/a_id/5584
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2024-12-06T19:48:03.087Z

Updated: 2024-12-10T16:59:15.863Z

Reserved: 2023-12-02T00:42:40.373Z

Link: CVE-2024-0130

Vulnrichment

Updated: 2024-12-10T16:59:10.273Z

NVD

Status : Received

Published: 2024-12-06T20:15:23.543

Modified: 2024-12-06T20:15:23.543

Link: CVE-2024-0130

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0130", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2023-12-02T00:42:40.373Z", "datePublished": "2024-12-06T19:48:03.087Z", "dateUpdated": "2024-12-10T16:59:15.863Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["RHEL 8", "RHEL 9", "Ubuntu20", "Ubuntu22"], "product": "UFM Enterprise GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "6.15.x, 6.16.x, 6.17.x"}]}, {"defaultStatus": "affected", "platforms": ["RHEL 7", "RHEL 8", "RHEL 9", "Ubuntu18", "Ubuntu20", "Ubuntu22"], "product": "UFM Enterprise LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "6.15.x LTS prior to 6.15.6-4 LTS"}]}, {"defaultStatus": "affected", "product": "UFM Enterprise Appliance GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "1.6.x, 1.7.x, 1.8.x"}]}, {"defaultStatus": "affected", "product": "UFM Enterprise Appliance LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "1.6.x LTS prior to 1.6.6-1 LTS"}]}, {"defaultStatus": "affected", "product": "UFM SDN Appliance GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "4.14.x, 4.15.x, 4.16.x"}]}, {"defaultStatus": "affected", "product": "UFM SDN Appliance LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "4.14.x LTS prior to 4.14.6.4 LTS"}]}, {"defaultStatus": "affected", "product": "UFM CyberAI GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "2.6.x, 2.7.x, 2.8.x"}]}, {"defaultStatus": "affected", "product": "UFM CyberAI LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "2.6.1-3 LTS"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<table><tbody><tr><td>NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.</td></tr></tbody></table><br>"}], "value": "NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of privileges, data tampering, denial of service, information disclosure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2024-12-06T19:48:03.087Z"}, "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5584"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-09T22:09:20.738912Z", "id": "CVE-2024-0130", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-10T16:59:15.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0130", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-09T22:09:20.738912Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-10T16:59:10.273Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of privileges, data tampering, denial of service, information disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "UFM Enterprise GA", "versions": [{"status": "affected", "version": "6.15.x, 6.16.x, 6.17.x"}], "platforms": ["RHEL 8", "RHEL 9", "Ubuntu20", "Ubuntu22"], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM Enterprise LTS23", "versions": [{"status": "affected", "version": "6.15.x LTS prior to 6.15.6-4 LTS"}], "platforms": ["RHEL 7", "RHEL 8", "RHEL 9", "Ubuntu18", "Ubuntu20", "Ubuntu22"], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM Enterprise Appliance GA", "versions": [{"status": "affected", "version": "1.6.x, 1.7.x, 1.8.x"}], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM Enterprise Appliance LTS23", "versions": [{"status": "affected", "version": "1.6.x LTS prior to 1.6.6-1 LTS"}], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM SDN Appliance GA", "versions": [{"status": "affected", "version": "4.14.x, 4.15.x, 4.16.x"}], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM SDN Appliance LTS23", "versions": [{"status": "affected", "version": "4.14.x LTS prior to 4.14.6.4 LTS"}], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM CyberAI GA", "versions": [{"status": "affected", "version": "2.6.x, 2.7.x, 2.8.x"}], "defaultStatus": "affected"}, {"vendor": "NVIDIA", "product": "UFM CyberAI LTS23", "versions": [{"status": "affected", "version": "2.6.1-3 LTS"}], "defaultStatus": "affected"}], "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5584"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.", "supportingMedia": [{"type": "text/html", "value": "<table><tbody><tr><td>NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.</td></tr></tbody></table><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2024-12-06T19:48:03.087Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0130", "state": "PUBLISHED", "dateUpdated": "2024-12-10T16:59:15.863Z", "dateReserved": "2023-12-02T00:42:40.373Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2024-12-06T19:48:03.087Z", "assignerShortName": "nvidia"}, "dataVersion": "5.1"}