CVE-2023-0209 HIGH

CVE-2023-0209

Vendor Nvidia

Product NVIDIA DGX servers

Weakness CWE-287 · Improper authentication

Published April 22, 2023

Last update February 4, 2025

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass.

Key dates

02Disclosure timeline

April 22, 2023 CVE published

February 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-0209 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2022-25817 CVE-2025-5985 code-projects School Fees Payment System improper authentication CVE-2023-5502 On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication. CVE-2026-4664 Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter CVE-2025-41064 Incorrect authentication in GTT´s group OpenSIAC