CVE-2020-11486
9.8
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.72% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-434 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-10-29 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| intel | bmc firmware |
| nvidia | dgx-1 |
References
→ the Explorer · watch your stack · NVD