CVE-2024-0130 Overview
CVE-2024-0130 is an improper authentication vulnerability [CWE-287] affecting NVIDIA Unified Fabric Manager (UFM) Enterprise, UFM Appliance, and UFM CyberAI products. An attacker on the adjacent network can send a malformed request through the Ethernet management interface to trigger the flaw. Successful exploitation may lead to privilege escalation, data tampering, denial of service, and information disclosure. The vulnerability requires no authentication and no user interaction, and it impacts confidentiality, integrity, and availability. NVIDIA published a customer support advisory describing affected versions and remediation guidance.
Critical Impact
Unauthenticated adjacent-network attackers can bypass authentication on NVIDIA UFM management interfaces, enabling privilege escalation, data tampering, denial of service, and disclosure of fabric management data.
Affected Products
- NVIDIA UFM Enterprise
- NVIDIA UFM Appliance
- NVIDIA UFM CyberAI
Discovery Timeline
- 2024-12-06 - CVE-2024-0130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0130
Vulnerability Analysis
The vulnerability resides in the authentication handling logic of the Ethernet management interface used by NVIDIA UFM products. UFM manages InfiniBand and Ethernet fabrics deployed in high-performance computing and AI data center environments. When the management interface receives a malformed request, it fails to properly validate identity before processing the request. An attacker positioned on the adjacent network can use this weakness to impersonate a privileged session or bypass identity checks entirely. The consequences span all three CIA properties, meaning a single exploit can pivot toward configuration tampering, exfiltration of fabric telemetry, or disruption of managed switches. Because UFM controls fabric-wide policy, compromising it can cascade into broader data center outages.
Root Cause
The root cause is improper authentication [CWE-287] in the request-processing path of the Ethernet management interface. The parser accepts malformed input that shifts execution into a state where authentication is not enforced, allowing unauthenticated actions against management APIs.
Attack Vector
Exploitation requires adjacent network access to the UFM Ethernet management interface. No credentials or user interaction are needed. An attacker sends a crafted, malformed request that the interface fails to authenticate, then issues follow-up commands as an authenticated principal. The vulnerability manifests only over the management network segment; see the NVIDIA Customer Support Advisory for technical details on affected versions and fixed releases.
Detection Methods for CVE-2024-0130
Indicators of Compromise
- Unexpected administrative actions or configuration changes on UFM appliances without a corresponding authenticated session in audit logs.
- Malformed HTTP or API requests to the UFM Ethernet management interface originating from hosts that do not normally administer the fabric.
- New or modified fabric policies, user accounts, or SNMP configurations appearing on UFM without an approved change ticket.
Detection Strategies
- Enable verbose authentication and API logging on UFM Enterprise, UFM Appliance, and UFM CyberAI, and forward events to a centralized SIEM for correlation.
- Baseline normal management traffic patterns and alert on protocol anomalies or malformed requests reaching the UFM management interface.
- Correlate UFM audit events with network flow data to identify management sessions initiated from unauthorized subnets.
Monitoring Recommendations
- Monitor the management VLAN for unexpected sources contacting UFM TCP ports.
- Alert on privileged UFM actions (user creation, partition changes, firmware operations) that lack a preceding authentication event.
- Track failed and malformed request rates against UFM as a leading indicator of probing.
How to Mitigate CVE-2024-0130
Immediate Actions Required
- Apply the security updates for UFM Enterprise, UFM Appliance, and UFM CyberAI as listed in the NVIDIA Customer Support Advisory.
- Restrict access to the UFM Ethernet management interface to a dedicated, tightly controlled management network.
- Review UFM audit logs for anomalous administrative actions since the affected versions were deployed.
Patch Information
NVIDIA has released fixed versions of UFM Enterprise, UFM Appliance, and UFM CyberAI. Refer to the NVIDIA Customer Support Advisory 5584 for the specific fixed versions applicable to each product line and upgrade instructions.
Workarounds
- Place UFM management interfaces behind a jump host or bastion accessible only via multi-factor authenticated VPN.
- Apply strict network ACLs so that only known administrator workstations can reach the UFM Ethernet management interface.
- Segment the UFM management network from tenant, workload, and general corporate networks to reduce adjacent-network exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
