Denis Kolegov

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware. This vulnerability occurs because the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As a result, it can lead to information disclosure or code execution.

The issue allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution. This is due to a vulnerability in the AMI BMC firmware.

The issue is related to the AMI BMC firmware in NVIDIA DGX servers, where the software does not validate the RSA 1024 public key used to verify the firmware signature. This may lead to information disclosure or code execution.

The issue is related to a weakness in the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package, which implements the IPMI protocol in the AMI BMC firmware. This weakness may lead to information disclosure because the PRNG algorithm is not cryptographically strong.