CVE-2023-31032
Nvidia Dgx A100 Firmware ≤ 1.25
Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-31032 is a high-severity Dynamic Variable Evaluation (CWE-627) vulnerability in Nvidia Dgx A100 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSA Secrets (T1003.004); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35369
Vulnerability Data
NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized reads/writes to dynamic code resources by applying authorization checks at access time.
Least privilege reduces the set of subjects that can reach or modify dynamic code resources, limiting the weakness's reach.
Input validation directly stops untrusted strings from being used as variable or function names in dynamic evaluation.
Secure engineering principles include avoiding or strictly controlling dynamic variable resolution from user input.
Isolating security functions from non-security code prevents unintended manipulation of dynamically managed executable resources.
Process isolation keeps each process's dynamic code resources in separate domains, blocking cross-process tampering.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent unsafe dynamic variable evaluation via input validation and code review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and variable handling rules that reduce dynamic evaluation risks.
A.8.26 only requires that security requirements (including resilience against injections) be identified and specified during development or acquisition; it does not itself enforce, implement or otherwise stop dynamic variable evaluation from being exploitable.
Secure architecture principles discourage unsafe dynamic evaluation constructs.
Secure coding standards directly prohibit or constrain dynamic variable evaluation to prevent arbitrary access.
Security testing can detect dynamic evaluation flaws but does not prevent them by itself.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-913, a class-level weakness, and none of its children carries one either.