CVE-2020-11488 - NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution

Back Back to CVE browser

MEDIUM

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution

Published Oct 29, 2020

6.7

MEDIUM

CVSS 3.1

EPSS 0.25%

Description

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution.

Affected products

Vendor NVIDIA Product NVIDIA DGX Servers Default
unknown
Affected
- All DGX-1 with BMC firmware versions prior to 3.38.30, and all DGX-2 with BMC firmware versions prior to 1.06.06

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
NVIDIA	NVIDIA DGX Servers	unknown	Affected All DGX-1 with BMC firmware versions prior to 3.38.30, and all DGX-2 with BMC firmware versions prior to 1.06.06

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-347

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3841
Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5010
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3841		Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5010		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner nvidia

Published Oct 29, 2020

Updated Aug 4, 2024

Reserved Apr 2, 2020

Link CVE-2020-11488

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-11488

Red Hat

No data

ENISA EUVD

Assigner nvidia

Published Oct 29, 2020

Updated Aug 4, 2024

Link EUVD-2020-3841

GitHub

No data