CVE-2022-42285

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to denial of service, escalation of privileges, or data tampering.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1231

Affected software

VendorProductVersions
NVIDIANVIDIA DGX serversAll SBIOS firmware versions prior to 1.18

References

Timeline

Published
Jan 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-422867.8DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges.CVE-2022-422877.8NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circCVE-2022-422885.3NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, wCVE-2022-422898.8NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to codCVE-2022-42299.8A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown codeCVE-2022-422908.8NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to codCVE-2022-422915.5NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadCVE-2022-422927.8NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a CVE-2022-422997.5An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a CVE-2022-42308.8The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL InjectionCVE-2022-423006.5An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can bCVE-2022-423018.8An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an
CVE-2022-42285: High severity, CVSS 7.8 | Vulnix