DGX H100 BMC: Privesc + code execution (web UI input validation)
CVSS 8.3CVE-2023-25533NVIDIA / GPU stackcurated
Impact
Privesc + code execution (web UI input validation)
Who can reach it
Authenticated BMC user on mgmt network
What to do
Flash BMC 23.08.18 out-of-band
References
Related entries
- DGX H100 BMC: Kernel memory corruptionCVE-2023-25527 · DGX H100 BMCHigh
- DGX H100 BMC (REST): Code execution + privescCVE-2023-31009 · DGX H100 BMC (REST)High
- Container Toolkit: Container escape to host filesystem (bypass of the CVE-2024-0132 fix)CVE-2025-23359 · Container ToolkitHigh
- Jetson Xavier / Orin: Authentication bypass in a network serviceCVE-2026-24148 · Jetson Xavier / OrinHigh
- NVIDIA DGX A100 - SBIOS / SMM firmware: The BiosCfgTool reads and writes outside its bounds in SMRAM, handingCVE-2022-28200 · NVIDIA DGX A100 - SBIOS / SMM firmwareHigh
- NVIDIA DGX A100 - SBIOS / SMM firmware: An uninitialised pointer in the Ofbd SMM handler gives a privileged local userCVE-2022-31599 · NVIDIA DGX A100 - SBIOS / SMM firmwareHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.