Arbitrary Command Injection in NVIDIA BMC SPX REST API

CVE-2022-42290

What is CVE-2022-42290?

The NVIDIA Baseboard Management Controller contains a vulnerability within its SPX REST API that allows an authorized attacker to inject arbitrary shell commands. This exploit could lead to various severe consequences, including unauthorized code execution, denial of service, confidential information disclosure, and potential data tampering. Organizations utilizing affected versions of the BMC should evaluate and mitigate risks associated with this vulnerability to ensure system integrity and security.

References