CVE-2020-11486

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-29 · updated 2026-06-17
Weakness: CWE-434

Description

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution.

Affected products

Intel Corporation Intel(R) Baseboard Management Controller (BMC) firmware: before 3.38.30 — fixed in 3.38.30

How to fix

Upgrade to a fixed version: Intel Corporation Intel(R) Baseboard Management Controller (BMC) firmware 3.38.30. Check the vendor advisory for mitigations.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5010
https://nvidia.custhelp.com/app/answers/detail/a_id/5010

Get alerted when CVE-2020-11486 or the next vulnerability affects your stack