Read the docs
TI-2023-00203 Aliases CVE-2023-0209GHSA-j2cw-x4g9-632w

Improper authentication in NVIDIA DGX servers

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIANVIDIA DGX serversAll SBIOS prior to S2W_3A13—No fix listedCNA
  • NVIDIA DGX servers VendorNVIDIA Affected All SBIOS prior to S2W_3A13 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:nvidia:sbios:*:*:*:*:*:*:*:*before 52w_3a13VulnerableNVIDIA
cpe:2.3:h:nvidia:dgx-1:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
  • cpe:2.3:o:nvidia:sbios:*:*:*:*:*:*:*:* Versions before 52w_3a13 Vulnerable ·NVIDIA
  • cpe:2.3:h:nvidia:dgx-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0209
  2. 2026-10-03 Alias added: GHSA-j2cw-x4g9-632w

References

Advisory 1

  • TI-2023-10811 Out-of-bounds write in NVIDIA DGX servers CVSS 3.1HIGH 8.2
  • TI-2022-20508 Memory corruption in NVIDIA DGX servers CVSS 3.1HIGH 7.8
  • TI-2022-20507 DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a… CVSS 3.1HIGH 7.8
  • TI-2023-00201 Incorrect permission assignment in NVIDIA DGX servers CVSS 3.1HIGH 7.5
  • TI-2023-10814 Memory corruption in NVIDIA DGX servers CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences