Discover · without an agent

Power inventory

Every power component, found on day one. Nothing installed. Read-only, through Redfish, IPMI, DCGM, SNMP and the switch APIs you already run: the BMCs, power supplies, voltage regulators, GPUs and rack power behind every server, with model, firmware and where the data came from.

Power inventory
408 power components · 11 vendors · discovered without an agent
Example scan · synthetic 24-node fleet Example
Sources DCGM 192Redfish 168Redfish (HMC) 24LLDP · gNMI 12SNMP 12
Layers BMC 24Power supply 48Voltage regulator 48GPU baseboard 24GPU 192CPU 48Rack power 12Mgmt port 12
Risk critical 17high 44medium 135low 9

What this run did every request is in the log

Read
442 requests to 2 addresses, all GET
442 answered · 0 refused · 0 no answer
Changed
nothing
Every request was a read. No setting, user or firmware was touched.
Kept
on this machine
/private/tmp/claude-501/-Users-samyoneidelman/db3a9059-b89e-424b-a975-84a0d280c044/scratchpad/demo2/inv.json
/private/tmp/claude-501/-Users-samyoneidelman/db3a9059-b89e-424b-a975-84a0d280c044/scratchpad/demo2/inv.requests.log
Sent
nothing else
No request went anywhere but the addresses counted here. The log holds no login.

Attack paths 10 paths · 10 critical

critical subnet:10.20.0.0/16 and 2 more -> BMC gpu-node-04 (CVE-2022-24422) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-04)
Reach
subnet:10.20.0.0/16
network
→
Takeover
gpu-node-04 · BMC
CVE-2022-24422
→
Manipulate
2 rail(s) of gpu-node-04
PMBus
→
Impact
11 accelerator(s) (gpu-node-04)
over/under-volt
→
Silicon
gpu-node-04/cpu0-vcore-vrm-rail no agent, gpu-node-04/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 90, a tenant stands at the door (already in the finding's score).
critical subnet:10.20.0.0/16 and 2 more -> BMC gpu-node-02 (CVE-2023-50272) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-02)
Reach
subnet:10.20.0.0/16
network
→
Takeover
gpu-node-02 · BMC
CVE-2023-50272
→
Manipulate
2 rail(s) of gpu-node-02
PMBus
→
Impact
11 accelerator(s) (gpu-node-02)
over/under-volt
→
Silicon
gpu-node-02/cpu0-vcore-vrm-rail no agent, gpu-node-02/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 84, a tenant stands at the door (already in the finding's score).
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-13 (CVE-2022-24422) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-13)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-13 · BMC
CVE-2022-24422
→
Manipulate
2 rail(s) of gpu-node-13
PMBus
→
Impact
11 accelerator(s) (gpu-node-13)
over/under-volt
→
Silicon
gpu-node-13/cpu0-vcore-vrm-rail no agent, gpu-node-13/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 70.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-24 (CVE-2022-24422) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-24)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-24 · BMC
CVE-2022-24422
→
Manipulate
2 rail(s) of gpu-node-24
PMBus
→
Impact
11 accelerator(s) (gpu-node-24)
over/under-volt
→
Silicon
gpu-node-24/cpu0-vcore-vrm-rail no agent, gpu-node-24/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 70.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-08 (CVE-2021-21538) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-08)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-08 · BMC
CVE-2021-21538
→
Manipulate
2 rail(s) of gpu-node-08
PMBus
→
Impact
11 accelerator(s) (gpu-node-08)
over/under-volt
→
Silicon
gpu-node-08/cpu0-vcore-vrm-rail no agent, gpu-node-08/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 65.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-17 (CVE-2021-21538) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-17)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-17 · BMC
CVE-2021-21538
→
Manipulate
2 rail(s) of gpu-node-17
PMBus
→
Impact
11 accelerator(s) (gpu-node-17)
over/under-volt
→
Silicon
gpu-node-17/cpu0-vcore-vrm-rail no agent, gpu-node-17/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 65.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-01 (CVE-2024-25943) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-01)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-01 · BMC
CVE-2024-25943
→
Manipulate
2 rail(s) of gpu-node-01
PMBus
→
Impact
11 accelerator(s) (gpu-node-01)
over/under-volt
→
Silicon
gpu-node-01/cpu0-vcore-vrm-rail no agent, gpu-node-01/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 64.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-12 (CVE-2024-25943) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-12)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-12 · BMC
CVE-2024-25943
→
Manipulate
2 rail(s) of gpu-node-12
PMBus
→
Impact
11 accelerator(s) (gpu-node-12)
over/under-volt
→
Silicon
gpu-node-12/cpu0-vcore-vrm-rail no agent, gpu-node-12/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 64.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-18 (CVE-2023-50272) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-18)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-18 · BMC
CVE-2023-50272
→
Manipulate
2 rail(s) of gpu-node-18
PMBus
→
Impact
11 accelerator(s) (gpu-node-18)
over/under-volt
→
Silicon
gpu-node-18/cpu0-vcore-vrm-rail no agent, gpu-node-18/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 64.
critical subnet:10.0.7.0/24 and 1 more -> BMC gpu-node-21 (CVE-2024-25943) -> 2 rail(s) -> 11 accelerator(s) 11 accelerator(s) (gpu-node-21)
Reach
subnet:10.0.7.0/24
network
→
Takeover
gpu-node-21 · BMC
CVE-2024-25943
→
Manipulate
2 rail(s) of gpu-node-21
PMBus
→
Impact
11 accelerator(s) (gpu-node-21)
over/under-volt
→
Silicon
gpu-node-21/cpu0-vcore-vrm-rail no agent, gpu-node-21/cpu1-vcore-vrm-rail no agent
unverified
Built by walking the graph: the entry, a confirmed takeover finding on the BMC, the host it manages, the rails of that host's accelerators. Nothing was exploited. Whether this BMC can write to those regulators is not checked. Silicon: no PWX-01 agent reports these rails, so what happens on the regulator is not verified. The scan does not know which rail feeds which accelerator, so every rail of the host counts. Priority: worst confirmed finding on the BMC 64.
This is one scan. PWX Monitor keeps watching: scan history and diffs, alerts when a new path, CVE or firmware change appears, real-time BMC events, SIEM export and signed IEC 62443 / NIS2 reports. Talk to us →

Findings 205 across the fleet · firmware CVEs and power-layer posture

critical
CVE-2022-24422
Dell iDRAC9: improper authentication (unauthenticated)firmware-cve
iDRAC9 firmware 5.00.00.00 up to (not including) 5.10.10.00 lets an unauthenticated remote attacker bypass authentication (NVD 9.8, Dell 9.6).
3× affected, e.g. gpu-node-04 · BMC, gpu-node-13 · BMC, gpu-node-24 · BMC
Fix: Update iDRAC9 to 5.10.10.00 or later (current release preferred). · ref
priority 90 · CVSS 9.8 (v3.1) · EPSS 0.59 (2026-10-28)
How this was decided (3)
gpu-node-04 · BMC · confirmed · priority 90
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-04-bmc) is inside the affected range >= 5.00.00.00 and < 5.10.10.00 for idrac9. Vendor advisory DSA-2022-068 (read 2026-10-29): fixed in iDRAC9 5.10.10.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-24422, record modified 2026-06-17T04:31:49.270); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.59 +6, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
Fixed in 5.10.10.00 · source
gpu-node-13 · BMC · confirmed · priority 70
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-13-bmc) is inside the affected range >= 5.00.00.00 and < 5.10.10.00 for idrac9. Vendor advisory DSA-2022-068 (read 2026-10-29): fixed in iDRAC9 5.10.10.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-24422, record modified 2026-06-17T04:31:49.270); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.59 +6, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.23 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.10.10.00 · source
gpu-node-24 · BMC · confirmed · priority 70
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-24-bmc) is inside the affected range >= 5.00.00.00 and < 5.10.10.00 for idrac9. Vendor advisory DSA-2022-068 (read 2026-10-29): fixed in iDRAC9 5.10.10.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-24422, record modified 2026-06-17T04:31:49.270); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.59 +6, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.34 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.10.10.00 · source
critical
CVE-2024-25943
Dell iDRAC9: IPMI session hijackingfirmware-cve
A remote attacker can hijack an IPMI session on iDRAC9 before 7.00.00.172 (14th generation) or before 7.10.50.00 (15th and 16th generation) (NVD 9.8, Dell 7.6). Between those two numbers the answer depends on the server generation, which the inventory may not carry.
8× affected, e.g. gpu-node-04 · BMC, gpu-node-01 · BMC, gpu-node-08 · BMC
Fix: Update iDRAC9 to 7.00.00.172 (14G) or 7.10.50.00 (15G/16G) or later; disable IPMI over LAN if unused. · ref
priority 84 · CVSS 9.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (8)
gpu-node-04 · BMC · confirmed · priority 84
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-04-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
gpu-node-01 · BMC · confirmed · priority 64
Firmware 6.10.30.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-01-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.11 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-08 · BMC · confirmed · priority 64
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-08-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-12 · BMC · confirmed · priority 64
Firmware 6.10.30.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-12-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.22 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-13 · BMC · confirmed · priority 64
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-13-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.23 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-17 · BMC · confirmed · priority 64
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-17-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-21 · BMC · confirmed · priority 64
Firmware 6.10.30.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-21-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.31 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-24 · BMC · confirmed · priority 64
Firmware 5.00.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-24-bmc) is inside the affected range < 7.00.00.172 for idrac9. Vendor advisory DSA-2024-099 (read 2026-10-29): fixed in iDRAC9 7.00.00.172 (14G); iDRAC9 7.10.50.00 (15G and 16G). Which of these applies depends on the server generation, which the inventory does not carry, so no single version is named. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-25943, record modified 2026-06-17T07:16:46.473); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.34 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
critical
CVE-2023-50272
HPE iLO 5/6: authentication bypassfirmware-cve
Remote authentication bypass in iLO 5 firmware from 2.63 up to before 3.00 and iLO 6 firmware from 1.05 up to before 1.55 (NVD 9.8, HPE 7.5; bulletin HPESBHF04584). NVD words the end of the range as 'through'; HPE's bulletin names 3.00 and 1.55 as the fixed releases, and that is what is applied here.
4× affected, e.g. gpu-node-02 · BMC, gpu-node-18 · BMC, gpu-node-06 · BMC
Fix: Update iLO 5 to 3.00 or later, iLO 6 to 1.55 or later (HPE bulletin HPESBHF04584). · ref
priority 84 · CVSS 9.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (4)
gpu-node-02 · BMC · confirmed · priority 84
Firmware 1.10 (HPE iLO 6, read from Redfish /redfish/v1/Managers/gpu-node-02-bmc) is inside the affected range >= 1.05 and < 1.55 for ilo6. Vendor advisory HPESBHF04584 (read 2026-10-29): fixed in iLO 5 v3.00; iLO 6 v1.55. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-50272, record modified 2026-06-17T06:39:25.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
Fixed in 1.55 · source
gpu-node-18 · BMC · confirmed · priority 64
Firmware 1.10 (HPE iLO 6, read from Redfish /redfish/v1/Managers/gpu-node-18-bmc) is inside the affected range >= 1.05 and < 1.55 for ilo6. Vendor advisory HPESBHF04584 (read 2026-10-29): fixed in iLO 5 v3.00; iLO 6 v1.55. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-50272, record modified 2026-06-17T06:39:25.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.28 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.55 · source
gpu-node-06 · BMC · confirmed · priority 64
NVD range >= 1.05 and <= 1.55 for CPE product integrated_lights-out_6_firmware, firmware 1.55 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-06-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-50272, NVD record modified 2026-06-17T06:39:25.780. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-50272, record modified 2026-06-17T06:39:25.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.16 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-22 · BMC · confirmed · priority 64
NVD range >= 1.05 and <= 1.55 for CPE product integrated_lights-out_6_firmware, firmware 1.55 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-22-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-50272, NVD record modified 2026-06-17T06:39:25.780. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-50272, record modified 2026-06-17T06:39:25.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.32 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
high
CVE-2021-36299
Dell iDRAC 9 firmware 5.00.00.00 is in the NVD affected range of CVE-2021-36299firmware-cve
Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.
5× affected, e.g. gpu-node-04 · BMC, gpu-node-08 · BMC, gpu-node-13 · BMC
Fix: Update the BMC firmware to 4.40.29.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 77 · CVSS 8.1 (v3.1) · EPSS 0.30 (2026-10-28)
How this was decided (5)
gpu-node-04 · BMC · confirmed · priority 77
NVD range = 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-04-bmc. NVD lists exact versions, not a range: a build between the listed versions is not judged either way. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36299, NVD record modified 2026-06-17T03:58:37.177. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36299, record modified 2026-06-17T03:58:37.177); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-36299.
score: CVSS 8.1 (v3.1) +49, EPSS 0.30 +3, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
Fixed in 4.40.29.00 · source
gpu-node-08 · BMC · confirmed · priority 57
NVD range >= 4.40.00.00 and < 4.40.29.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36299, NVD record modified 2026-06-17T03:58:37.177. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36299, record modified 2026-06-17T03:58:37.177); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-36299.
score: CVSS 8.1 (v3.1) +49, EPSS 0.30 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.29.00 · source
gpu-node-13 · BMC · confirmed · priority 57
NVD range = 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-13-bmc. NVD lists exact versions, not a range: a build between the listed versions is not judged either way. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36299, NVD record modified 2026-06-17T03:58:37.177. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36299, record modified 2026-06-17T03:58:37.177); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-36299.
score: CVSS 8.1 (v3.1) +49, EPSS 0.30 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.23 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.29.00 · source
gpu-node-17 · BMC · confirmed · priority 57
NVD range >= 4.40.00.00 and < 4.40.29.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36299, NVD record modified 2026-06-17T03:58:37.177. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36299, record modified 2026-06-17T03:58:37.177); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-36299.
score: CVSS 8.1 (v3.1) +49, EPSS 0.30 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.29.00 · source
gpu-node-24 · BMC · confirmed · priority 57
NVD range = 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-24-bmc. NVD lists exact versions, not a range: a build between the listed versions is not judged either way. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36299, NVD record modified 2026-06-17T03:58:37.177. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36299, record modified 2026-06-17T03:58:37.177); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-36299.
score: CVSS 8.1 (v3.1) +49, EPSS 0.30 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.34 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.29.00 · source
high
CVE-2023-30911
HPE iLO 6 firmware 1.10 is in the NVD affected range of CVE-2023-30911firmware-cve
HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.
2× affected, e.g. gpu-node-02 · BMC, gpu-node-18 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 70 · CVSS 7.5 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-02 · BMC · confirmed · priority 70
NVD range < 1.53 for CPE product integrated_lights-out_6_firmware, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-02-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-30911, NVD record modified 2026-06-17T05:55:52.870. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-30911, record modified 2026-06-17T05:55:52.870); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
gpu-node-18 · BMC · confirmed · priority 50
NVD range < 1.53 for CPE product integrated_lights-out_6_firmware, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-18-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-30911, NVD record modified 2026-06-17T05:55:52.870. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-30911, record modified 2026-06-17T05:55:52.870); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.28 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
high
PWX-NET-TENANT-OOB
BMC management plane reachable from a tenant networknetwork-exposure
10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
3× affected, e.g. gpu-node-02 · BMC, gpu-node-04 · BMC, gpu-node-09 · BMC
priority 67
How this was decided (3)
gpu-node-02 · BMC · confirmed · priority 67
The out-of-band management plane is reachable from a tenant network: subnet:10.20.0.0/16 on 443 (oob-sw-01.cfg:33). The BMC plane should not be reachable from tenant workloads; remove the permit or move the BMC off a tenant-routable segment.
score: severity high +42, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
gpu-node-04 · BMC · confirmed · priority 67
The out-of-band management plane is reachable from a tenant network: subnet:10.20.0.0/16 on 443 (oob-sw-01.cfg:34). The BMC plane should not be reachable from tenant workloads; remove the permit or move the BMC off a tenant-routable segment.
score: severity high +42, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
gpu-node-09 · BMC · confirmed · priority 67
The out-of-band management plane is reachable from a tenant network: subnet:10.20.0.0/16 on 443 (oob-sw-01.cfg:35). The BMC plane should not be reachable from tenant workloads; remove the permit or move the BMC off a tenant-routable segment.
score: severity high +42, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.19 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:35)
critical
CVE-2021-21538
Dell iDRAC9: improper authentication (unauthenticated)firmware-cve
iDRAC9 firmware 4.40.00.00 up to (not including) 4.40.10.00 lets an unauthenticated remote attacker bypass authentication (NVD 10.0, Dell 9.6).
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update iDRAC9 to 4.40.10.00 or later (current release preferred). · ref
priority 65 · CVSS 10.0 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 65
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-08-bmc) is inside the affected range >= 4.40.00.00 and < 4.40.10.00 for idrac9. Vendor advisory DSA-2021-082 (read 2026-10-29): fixed in iDRAC9 4.40.10.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21538, record modified 2026-06-17T03:35:44.390); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.10.00 · source
gpu-node-17 · BMC · confirmed · priority 65
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-17-bmc) is inside the affected range >= 4.40.00.00 and < 4.40.10.00 for idrac9. Vendor advisory DSA-2021-082 (read 2026-10-29): fixed in iDRAC9 4.40.10.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21538, record modified 2026-06-17T03:35:44.390); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.10.00 · source
medium
CVE-2026-63457
HPE iLO 6 firmware 1.10 is in the NVD affected range of CVE-2026-63457firmware-cve
A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78.
6× affected, e.g. gpu-node-02 · BMC, gpu-node-06 · BMC, gpu-node-10 · BMC
Fix: Update the BMC firmware to 1.78 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 64 · CVSS 6.5 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (6)
gpu-node-02 · BMC · confirmed · priority 64
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-02-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
Fixed in 1.78 · source
gpu-node-06 · BMC · confirmed · priority 44
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.55 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-06-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.16 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.78 · source
gpu-node-10 · BMC · confirmed · priority 44
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.62 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-10-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.20 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.78 · source
gpu-node-14 · BMC · confirmed · priority 44
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.73 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-14-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.24 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.78 · source
gpu-node-18 · BMC · confirmed · priority 44
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-18-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.28 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.78 · source
gpu-node-22 · BMC · confirmed · priority 44
NVD range < 1.78 for CPE product integrated_lights-out_6_firmware, firmware 1.55 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-22-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63457, NVD record modified 2026-10-24T16:10:00.153. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-63457, record modified 2026-10-24T16:10:00.153); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2026-63457.
score: CVSS 6.5 (v3.1) +39, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.32 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 1.78 · source
high
CVE-2024-54085
AMI MegaRAC SPx: Redfish Host Interface authentication bypass (version not confirmed)firmware-cve
Authentication can be bypassed through the Redfish Host Interface, giving a remote attacker control of the BMC. AMI lists SPx 12.0 to before 12.7 and 13.0 to before 13.5. CISA added it to its exploited-vulnerabilities list on 2025-06-25. The SPx version is not exposed over Redfish, so confirm it against your server vendor's BMC advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware that includes the fixed AMI SPx; restrict Redfish and the Host Interface to a management network. · ref
priority 61 · exploited in the wild (CISA KEV) · CVSS 10.0 (v4.0) · EPSS 0.61 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 61
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2025003 (read 2026-10-29): fixed in SPx_12.7+; SPx_13.5. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-54085, record modified 2026-06-17T08:09:44.677); listed in CISA KEV (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 2026.10.28, released 2026-10-28T19:00:04.8077Z); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v4.0) +60, exploited (KEV) +25, EPSS 0.61 +6, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
high
CVE-2021-36300
Dell iDRAC9: unauthenticated request can crash the web server or disclose informationfirmware-cve
Improper input validation lets an unauthenticated remote party crash the iDRAC9 web server or read information (NVD 8.2). Affects iDRAC9 before 5.00.00.00.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update iDRAC9 to 5.00.00.00 or later. · ref
priority 58 · CVSS 8.2 (v3.1) · EPSS 0.33 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 58
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-08-bmc) is inside the affected range < 5.00.00.00 for idrac9. Vendor advisory DSA-2021-177 (read 2026-10-29): fixed in iDRAC9 5.00.00.00. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36300, record modified 2026-06-17T03:58:37.280); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.2 (v3.1) +49, EPSS 0.33 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.00.00.00 · source
gpu-node-17 · BMC · confirmed · priority 58
Firmware 4.40.00.00 (Dell iDRAC9, read from Redfish /redfish/v1/Managers/gpu-node-17-bmc) is inside the affected range < 5.00.00.00 for idrac9. Vendor advisory DSA-2021-177 (read 2026-10-29): fixed in iDRAC9 5.00.00.00. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36300, record modified 2026-06-17T03:58:37.280); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.2 (v3.1) +49, EPSS 0.33 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.00.00.00 · source
medium
CVE-2023-28083
HPE iLO 6 firmware 1.10 is in the NVD affected range of CVE-2023-28083firmware-cve
A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.
2× affected, e.g. gpu-node-02 · BMC, gpu-node-18 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 57 · CVSS 5.4 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (2)
gpu-node-02 · BMC · confirmed · priority 57
NVD range < 1.20 for CPE product integrated_lights-out_6, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-02-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-28083, NVD record modified 2026-06-17T05:46:49.443. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28083, record modified 2026-06-17T05:46:49.443); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.4 (v3.1) +32, EPSS 0.00 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.12 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:33)
gpu-node-18 · BMC · confirmed · priority 37
NVD range < 1.20 for CPE product integrated_lights-out_6, firmware 1.10 (HPE iLO 6) read from Redfish /redfish/v1/Managers/gpu-node-18-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-28083, NVD record modified 2026-06-17T05:46:49.443. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28083, record modified 2026-06-17T05:46:49.443); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.4 (v3.1) +32, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.28 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2025-26482
Dell iDRAC 9 firmware 5.00.00.00 is in the NVD affected range of CVE-2025-26482firmware-cve
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
10× affected, e.g. gpu-node-04 · BMC, gpu-node-01 · BMC, gpu-node-05 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 54 · CVSS 4.9 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (10)
gpu-node-04 · BMC · confirmed · priority 54
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-04-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
gpu-node-01 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 6.10.30.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-01-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.11 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-05 · BMC · confirmed · priority 34
NVD range < 7.20.10.50 for CPE product idrac9_firmware, firmware 7.10.50.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-05-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.15 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-08 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-12 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 6.10.30.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-12-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.22 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-13 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-13-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.23 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-16 · BMC · confirmed · priority 34
NVD range < 7.20.10.50 for CPE product idrac9_firmware, firmware 7.10.50.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-16-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.26 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-17 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-21 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 6.10.30.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-21-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.31 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-24 · BMC · confirmed · priority 34
NVD range < 7.00.00.181 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-24-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-26482, NVD record modified 2026-06-17T09:01:52.730. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-26482, record modified 2026-06-17T09:01:52.730); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.34 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2022-34435
Dell iDRAC 9 firmware 5.00.00.00 is in the NVD affected range of CVE-2022-34435firmware-cve
Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.
5× affected, e.g. gpu-node-04 · BMC, gpu-node-08 · BMC, gpu-node-13 · BMC
Fix: Update the BMC firmware to 6.00.30.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 54 · CVSS 4.9 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (5)
gpu-node-04 · BMC · confirmed · priority 54
NVD range < 6.00.30.00 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-04-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2022-34435, NVD record modified 2026-06-17T04:50:21.123. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-34435, record modified 2026-06-17T04:50:21.123); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2022-34435.
score: CVSS 4.9 (v3.1) +29, EPSS 0.01 +0, a tenant network can reach it +20, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.14 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; subnet:10.20.0.0/16 is role tenant from the VLAN name "TENANT" in oob-sw-01.cfg:13, permitted by oob-sw-01.cfg:34)
Fixed in 6.00.30.00 · source
gpu-node-08 · BMC · confirmed · priority 34
NVD range < 6.00.30.00 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2022-34435, NVD record modified 2026-06-17T04:50:21.123. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-34435, record modified 2026-06-17T04:50:21.123); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2022-34435.
score: CVSS 4.9 (v3.1) +29, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 6.00.30.00 · source
gpu-node-13 · BMC · confirmed · priority 34
NVD range < 6.00.30.00 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-13-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2022-34435, NVD record modified 2026-06-17T04:50:21.123. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-34435, record modified 2026-06-17T04:50:21.123); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2022-34435.
score: CVSS 4.9 (v3.1) +29, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.23 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 6.00.30.00 · source
gpu-node-17 · BMC · confirmed · priority 34
NVD range < 6.00.30.00 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2022-34435, NVD record modified 2026-06-17T04:50:21.123. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-34435, record modified 2026-06-17T04:50:21.123); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2022-34435.
score: CVSS 4.9 (v3.1) +29, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 6.00.30.00 · source
gpu-node-24 · BMC · confirmed · priority 34
NVD range < 6.00.30.00 for CPE product idrac9_firmware, firmware 5.00.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-24-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2022-34435, NVD record modified 2026-06-17T04:50:21.123. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-34435, record modified 2026-06-17T04:50:21.123); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2022-34435.
score: CVSS 4.9 (v3.1) +29, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.34 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 6.00.30.00 · source
high
CVE-2021-36301
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-36301firmware-cve
Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 51 · CVSS 7.2 (v3.1) · EPSS 0.28 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 51
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36301, NVD record modified 2026-06-17T03:58:37.390. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36301, record modified 2026-06-17T03:58:37.390); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.2 (v3.1) +43, EPSS 0.28 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-17 · BMC · confirmed · priority 51
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-36301, NVD record modified 2026-06-17T03:58:37.390. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-36301, record modified 2026-06-17T03:58:37.390); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.2 (v3.1) +43, EPSS 0.28 +3, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2020-26198
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2020-26198firmware-cve
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range = 4.40.00.00 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. NVD lists exact versions, not a range: a build between the listed versions is not judged either way. Source: https://nvd.nist.gov/vuln/detail/CVE-2020-26198, NVD record modified 2026-06-17T03:07:48.847. Applicability: unknown. needs the web-ui service (inferred from the CVE description): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2020-26198, record modified 2026-06-17T03:07:48.847); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-17 · BMC · confirmed · priority 42
NVD range = 4.40.00.00 for CPE product idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. NVD lists exact versions, not a range: a build between the listed versions is not judged either way. Source: https://nvd.nist.gov/vuln/detail/CVE-2020-26198, NVD record modified 2026-06-17T03:07:48.847. Applicability: unknown. needs the web-ui service (inferred from the CVE description): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2020-26198, record modified 2026-06-17T03:07:48.847); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2021-21576
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21576firmware-cve
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to 4.40.40.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21576, NVD record modified 2026-06-17T03:35:48.930. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21576, record modified 2026-06-17T03:35:48.930); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21576.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
gpu-node-17 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21576, NVD record modified 2026-06-17T03:35:48.930. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21576, record modified 2026-06-17T03:35:48.930); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21576.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
medium
CVE-2021-21577
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21577firmware-cve
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to 4.40.40.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21577, NVD record modified 2026-06-17T03:35:49.033. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21577, record modified 2026-06-17T03:35:49.033); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21577.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
gpu-node-17 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21577, NVD record modified 2026-06-17T03:35:49.033. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21577, record modified 2026-06-17T03:35:49.033); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21577.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
medium
CVE-2021-21578
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21578firmware-cve
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to 4.40.40.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21578, NVD record modified 2026-06-17T03:35:49.147. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21578, record modified 2026-06-17T03:35:49.147); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21578.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
gpu-node-17 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21578, NVD record modified 2026-06-17T03:35:49.147. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21578, record modified 2026-06-17T03:35:49.147); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21578.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
medium
CVE-2021-21579
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21579firmware-cve
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to 4.40.40.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21579, NVD record modified 2026-06-17T03:35:49.250. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21579, record modified 2026-06-17T03:35:49.250); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21579.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
gpu-node-17 · BMC · confirmed · priority 42
NVD range < 4.40.40.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21579, NVD record modified 2026-06-17T03:35:49.250. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21579, record modified 2026-06-17T03:35:49.250); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21579.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 4.40.40.00 · source
medium
CVE-2021-21581
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21581firmware-cve
Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to 5.00.00.00 or later (NVD versionEndExcluding); confirm against the vendor advisory. · ref
priority 42 · CVSS 6.1 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 42
NVD range < 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21581, NVD record modified 2026-06-17T03:35:49.463. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21581, record modified 2026-06-17T03:35:49.463); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21581.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.00.00.00 · source
gpu-node-17 · BMC · confirmed · priority 42
NVD range < 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21581, NVD record modified 2026-06-17T03:35:49.463. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21581, record modified 2026-06-17T03:35:49.463); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2021-21581.
score: CVSS 6.1 (v3.1) +37, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 5.00.00.00 · source
medium
CVE-2022-40259
AMI MegaRAC SPx: arbitrary code execution through Redfish (version not confirmed)firmware-cve
AMI advisory AMI-SA-2023001 titles it Redfish arbitrary code execution; NVD rates it critical. Fixed in SPx_12 update 7.00 and SPx_13 update 5.00. The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware that carries SPx_12 update 7.00 / SPx_13 update 5.00 or later; keep the BMC off untrusted networks. · ref
priority 41 · CVSS 9.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 41
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40259, record modified 2026-06-17T05:01:11.157); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2019-16649
Supermicro BMC: virtual media lets an attacker capture credentials and attach USB devices (version not confirmed)firmware-cve
Encryption and authentication flaws in the BMC virtual media service on Supermicro H11, H12, M11, X9, X10 and X11 boards expose BMC credentials and let an attacker plug virtual USB devices into the server (NVD 10.0). The fixed firmware differs per board.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware Supermicro lists for your board; block the virtual media port (TCP 623) outside the management network. · ref
priority 39 · CVSS 10.0 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 39
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the virtual-media service (from the advisory text): the BMC does not report VirtualMedia as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2019-16649, record modified 2026-06-17T02:22:29.393); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 10.0 (v3.1) +60, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2022-26872
AMI MegaRAC SPx: password reset can be intercepted through the API (version not confirmed)firmware-cve
A password reset on AMI MegaRAC SPx 12 and 13 can be intercepted through the API (NVD 8.8, no authentication required). The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware with the fixed SPx; restrict the BMC web/API to a management network. · ref
priority 38 · CVSS 8.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-26872, record modified 2026-06-17T04:36:02.780); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2022-40242
AMI MegaRAC SPx: built-in default credentials (version not confirmed)firmware-cve
Built-in login credentials ship in AMI MegaRAC SPx 12 (through update 6.00) and SPx 13 (through update 4.00) and let a remote party in without valid credentials. The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Update the BMC firmware; change or disable default accounts; keep the BMC off untrusted networks. · ref
priority 38 · CVSS 9.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023001 (read 2026-10-29): fixed in SPx12-update-7.00; SPx13-update-5.00. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-40242, record modified 2026-06-17T05:01:10.363); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-34330
AMI MegaRAC SPx: code injection through the Dynamic Redfish Extension (version not confirmed)firmware-cve
A user can inject code that runs through the Dynamic Redfish Extension interface (SPx 12.0 to before 12.4 and 13.0 to before 13.2 per AMI). The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware with the fixed SPx; limit who holds a BMC account. · ref
priority 38 · CVSS 8.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.2. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34330, record modified 2026-06-17T06:03:24.540); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.8 (v3.1) +53, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-35861
Supermicro BMC: shell injection through e-mail notifications (version not confirmed)firmware-cve
A shell injection in BMC e-mail notifications lets a remote attacker run commands as root on the BMC (NVD 9.8). NVD lists H12DST-B before 03.10.35 and several X13 boards. The fixed firmware differs per board.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware Supermicro lists for your board. · ref
priority 38 · CVSS 9.8 (v3.1) · EPSS 0.02 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
gpu-node-07 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
gpu-node-11 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
gpu-node-15 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
gpu-node-19 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
gpu-node-23 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-35861, record modified 2026-06-17T06:05:21.837); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28; fixed version from https://nvd.nist.gov/vuln/detail/CVE-2023-35861.
score: CVSS 9.8 (v3.1) +59, EPSS 0.02 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
Fixed in 03.10.35 · source
medium
CVE-2024-36435
Supermicro BMC: unauthenticated buffer overflow in the web server (version not confirmed)firmware-cve
An unauthenticated buffer overflow in the BMC web server (GetValue) affects select X11, X12, H12, B12, X13, H13 and B13 boards and CMM6 modules (NVD 9.8). The fixed firmware differs per board, so check your board against Supermicro's July 2024 BMC/IPMI advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware named for your board in Supermicro's advisory; keep the BMC off untrusted networks. · ref
priority 38 · CVSS 9.8 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 38
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2024-36435, record modified 2026-06-17T07:36:42.800); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.8 (v3.1) +59, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-28863
AMI MegaRAC SPx12/SPx13: IPMI 2.0 cipher algorithms not enforced (version not confirmed)firmware-cve
AMI advisory AMI-SA-2023003 titles it a failure to enforce cipher algorithms for IPMI 2.0 (NVD 9.1, no authentication required). Fixed in SPx_12 update 7.00 and SPx_13 update 6.00. The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware that carries SPx_12 update 7.00 / SPx_13 update 6.00 or later; disable IPMI over LAN if unused. · ref
priority 36 · CVSS 9.1 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 36
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023003 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-6.00. Applicability: unknown. needs the ipmi-lan service (from the advisory text): the BMC does not report IPMI as enabled or disabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-28863, record modified 2026-06-17T05:48:56.307); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 9.1 (v3.1) +55, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-34329
AMI MegaRAC SPx: authentication bypass by HTTP header spoofing (version not confirmed)firmware-cve
A crafted HTTP header bypasses authentication on AMI MegaRAC SPx 12 (before 12.4 per AMI). The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware with the fixed SPx; put Redfish behind an authenticated proxy. · ref
priority 35 · CVSS 8.0 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 35
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023006 (read 2026-10-29): fixed in SPx_12.4; SPx_13.0. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-34329, record modified 2026-06-17T06:03:24.403); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 8.0 (v3.1) +48, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2025-22397
Dell iDRAC 9 firmware 7.10.50.00 is in the NVD affected range of CVE-2025-22397firmware-cve
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
2× affected, e.g. gpu-node-05 · BMC, gpu-node-16 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 34 · CVSS 4.9 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (2)
gpu-node-05 · BMC · confirmed · priority 34
NVD range >= 7.00.00.183 and < 7.20.10.50 for CPE product idrac9_firmware, firmware 7.10.50.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-05-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-22397, NVD record modified 2026-10-18T21:10:00.120. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-22397, record modified 2026-10-18T21:10:00.120); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.15 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-16 · BMC · confirmed · priority 34
NVD range >= 7.00.00.183 and < 7.20.10.50 for CPE product idrac9_firmware, firmware 7.10.50.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-16-bmc. NVD lists 2 ranges for this product (one per fixed branch): a version in another branch is judged by that branch's own bound, and the fixed version for this branch is the upper bound of the matched range. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-22397, NVD record modified 2026-10-18T21:10:00.120. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-22397, record modified 2026-10-18T21:10:00.120); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.9 (v3.1) +29, EPSS 0.00 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.26 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-25191
AMI MegaRAC SPx: credentials disclosed through Redfish (version not confirmed)firmware-cve
Account credentials are exposed over the network through the Redfish interface without authentication. AMI fixed it in SPx_12-update-7.00 and SPx_13-update-5.00. The SPx version is not exposed over Redfish; confirm it against your server vendor's advisory.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Install the BMC firmware with SPx 12 update 7.00 / SPx 13 update 5.00 or later; rotate BMC passwords afterwards. · ref
priority 33 · CVSS 7.5 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (6)
gpu-node-03 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 33
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names an AMI SPx build, and the SPx version is not exposed over Redfish. The scan can neither confirm nor exclude it. Vendor advisory AMI-SA-2023002 (read 2026-10-29): fixed in SPx_12-update-7.00; SPx_13-update-5.00. Applicability: active. needs the redfish service (from the advisory text): the scan reached this BMC through Redfish, so the Redfish service is enabled. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2023-25191, record modified 2026-06-17T05:40:53.133); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 7.5 (v3.1) +45, EPSS 0.01 +0, reachable only from the management network, as intended +0, the vulnerable service is enabled +5, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2021-21580
Dell iDRAC 9 firmware 4.40.00.00 is in the NVD affected range of CVE-2021-21580firmware-cve
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.
2× affected, e.g. gpu-node-08 · BMC, gpu-node-17 · BMC
Fix: Update the BMC firmware to a version outside the NVD affected range; the vendor advisory names the fixed build. · ref
priority 31 · CVSS 4.3 (v3.1) · EPSS 0.01 (2026-10-28)
How this was decided (2)
gpu-node-08 · BMC · confirmed · priority 31
NVD range < 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-08-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21580, NVD record modified 2026-06-17T03:35:49.350. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21580, record modified 2026-06-17T03:35:49.350); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.3 (v3.1) +26, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.18 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-17 · BMC · confirmed · priority 31
NVD range < 5.00.00.00 for CPE product emc_idrac9_firmware, firmware 4.40.00.00 (Dell iDRAC9) read from Redfish /redfish/v1/Managers/gpu-node-17-bmc. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-21580, NVD record modified 2026-06-17T03:35:49.350. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-21580, record modified 2026-06-17T03:35:49.350); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 4.3 (v3.1) +26, EPSS 0.01 +0, reachable only from the management network, as intended +0, GPU node +5 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.27 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
high
CVE-2022-43309
PMFault: unauthenticated PMBus rail manipulationfirmware-cve
PMBus 1.x has no authentication on VOUT_COMMAND; a compromised BMC can rewrite the VRM setpoint and damage the CPU/GPU rail (PMFault, CHES 2023).
24× affected, e.g. gpu-node-01 · VRM, gpu-node-02 · VRM, gpu-node-03 · VRM
Fix: Enable VRM write-protection; deploy the PWX-06 inline command filter; monitor the rail with the agent. · ref
priority 23 · CVSS 5.5 (v3.1) · EPSS 0.00 (2026-10-28)
How this was decided (24)
gpu-node-01 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-02 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-03 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-04 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-05 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-06 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-07 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-08 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-09 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-10 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-11 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-12 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-13 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-14 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-15 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-16 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-17 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-18 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-19 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-20 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-21 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-22 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-23 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-24 · VRM · possible · priority 23
A voltage regulator is in the inventory of this node. This is a design weakness of PMBus, not a match against the regulator's firmware: the scan lists it for every node with a regulator and does not test the regulator. Scoring data: CVSS from NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-43309, record modified 2026-07-09T01:17:51.310); EPSS from https://epss.empiricalsecurity.com/epss_scores-current.csv.gz, scored 2026-10-28.
score: CVSS 5.5 (v3.1) +33, EPSS 0.00 +0, GPU node +5, version not confirmed x0.6 · reachability: not assessed
medium
PWX-RAIL-WP
Rail write-protection not verifiedposture
VOUT write-protect state could not be confirmed read-only; the rail may accept setpoint changes.
24× affected, e.g. gpu-node-01 · VRM, gpu-node-02 · VRM, gpu-node-03 · VRM
Fix: Confirm/enable write-protect on the regulator; add the agent for runtime rail verdicts.
priority 17
How this was decided (24)
gpu-node-01 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-02 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-03 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-04 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-05 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-06 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-07 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-08 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-09 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-10 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-11 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-12 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-13 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-14 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-15 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-16 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-17 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-18 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-19 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-20 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-21 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-22 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-23 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
gpu-node-24 · VRM · possible · priority 17
Redfish does not expose the PMBus write-protect state, so the scan could not read it. The finding applies to every node with a regulator until the state is confirmed.
score: severity medium +24, GPU node +5, version not confirmed x0.6 · reachability: not assessed
medium
CVE-2023-33412
Supermicro X11/M11 BMC: command execution through the web interface (version not confirmed)firmware-cve
Authenticated users can run arbitrary commands through vulnerable CGI endpoints of the BMC web interface on X11 and M11 boards with firmware before 3.17.02 (NVD 8.8). The board firmware version is not reliably exposed over Redfish.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Update the BMC firmware to the version Supermicro lists for your board (after 3.17.02); limit BMC accounts. · ref
priority 17
How this was decided (6)
gpu-node-03 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
medium
CVE-2023-33413
Supermicro X11/M11 BMC: command execution through the configuration function (version not confirmed)firmware-cve
Authenticated users can run arbitrary commands through the BMC configuration function on X11 and M11 boards with firmware through 3.17.02 (NVD 8.8). The board firmware version is not reliably exposed over Redfish.
6× affected, e.g. gpu-node-03 · BMC, gpu-node-07 · BMC, gpu-node-11 · BMC
Fix: Update the BMC firmware to the version Supermicro lists for your board (after 3.17.02); limit BMC accounts. · ref
priority 17
How this was decided (6)
gpu-node-03 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-03-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.13 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-07 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-07-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.17 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-11 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-11-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.21 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-15 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.03.12" read from Redfish /redfish/v1/Managers/gpu-node-15-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.25 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-19 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.04.02" read from Redfish /redfish/v1/Managers/gpu-node-19-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.29 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
gpu-node-23 · BMC · possible · priority 17
Product matched (Supermicro AMI MegaRAC SP-X (AST2600), firmware "01.02.15" read from Redfish /redfish/v1/Managers/gpu-node-23-bmc). The advisory names a board or BMC build that Redfish does not report as the firmware version. The scan can neither confirm nor exclude it. Applicability: unknown. needs the web-ui service (from the advisory text): the BMC does not report HTTPS or HTTP as enabled or disabled.
score: severity medium +24, reachable only from the management network, as intended +0, GPU node +5, version not confirmed x0.6 · reachability: reachable: 10.0.7.0/24 can reach 10.100.0.33 on port 443: every ACL on the inbound path permits it (subnet:10.0.7.0/24 is role mgmt from the VLAN name "MGMT" in oob-sw-01.cfg:9; subnet:10.100.0.0/24 is role mgmt from the VLAN name "OOB" in oob-sw-01.cfg:11; not reachable from tenant subnet:10.20.0.0/16, blocked by oob-sw-01.cfg:36)
low
PWX-FW-HGX
GPU baseboard firmware behind baselineposture
HGX HMC firmware 24.02 is below the 24.03 baseline.
9× affected, e.g. gpu-node-01, gpu-node-05, gpu-node-06
Fix: Schedule HMC firmware update to the current baseline.
priority 17
How this was decided (9)
gpu-node-01 · confirmed · priority 17
HMC firmware "24.02" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-05 · confirmed · priority 17
HMC firmware "24.01" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-06 · confirmed · priority 17
HMC firmware "24.02" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-10 · confirmed · priority 17
HMC firmware "24.01" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-11 · confirmed · priority 17
HMC firmware "24.02" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-15 · confirmed · priority 17
HMC firmware "24.01" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-16 · confirmed · priority 17
HMC firmware "24.02" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-20 · confirmed · priority 17
HMC firmware "24.01" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
gpu-node-21 · confirmed · priority 17
HMC firmware "24.02" read from Redfish (HMC) compared with the baseline 24.03.
score: severity low +12, GPU node +5 · reachability: not assessed
method
How to read these findings
confirmed: the product matches and the firmware version is inside the affected range. possible: the product matches but the version cannot decide it (unreadable, or the advisory names a version Redfish does not expose); it counts 0.6 of its score and opens no attack path. Priority 0 to 100 = CVSS x 6 (or the severity label), +25 exploited (CISA KEV), +10 x EPSS, +20 tenant network can reach it / +10 other source / 0 management network only / -15 not reachable, +5 GPU node. Open "How this was decided" under a finding for the facts behind it.
Built-in CVE set: 45 advisories read from NVD up to 2026-10-26. The set changes with the binary; a CVE bundle (--cve-bundle) adds newer data.
CVE bundle built 2026-10-29 from NVD records via https://discover.bareket.ai (hub updated 2026-10-29T09:17:38.562Z): 248 CVEs, 114 of them without a machine-readable version range; a BMC that matches none of them is not shown safe, it is shown unassessed for those.
287 NVD ranges were not used because a bound is a date or a build id rather than a version; 47 CVEs have no usable range for that reason and are among the unassessed.
Exploited (KEV) marks from the CISA catalog 2026.10.28 released 2026-10-28T19:00:04.8077Z: 1 of the bundle's CVEs.
EPSS probabilities from FIRST, score date 2026-10-28: 248 of the bundle's CVEs scored. In an air gap they age with the bundle.
Fixed versions in the bundle come from NVD versionEndExcluding alone (70 CVEs); vendor advisory versions, where the scanner has them, take precedence.
The bundle's NVD ranges were applied to every BMC with a readable firmware version: 56 finding(s) beyond the built-in CVE set, each confirmed by product and range (the basis of each names the range and the record). AMI MegaRAC SPx products are not matched this way: the version Redfish reports is not the SPx version.
The CVE bundle's Ed25519 signature was verified before use.
Reachability modeled from imported configs (oob-sw-01.cfg): L2 same-VLAN plus L3 ACL first-match by direction (BMC SVI out + source SVI in); anything not fully understood (object-groups, VRFs, NAT, policy routing, a port ACL off the SVI path) is reported unknown with the line, never not-reachable; BMC IPs taken from the Redfish NIC, else the scanned endpoint.
Owners from owners file owners.csv (4 rules). First hit wins: a rule for the node or the component model, the tenant holding the node at scan time, the rack then the site, the Redfish AssetTag. Each finding's owner says which answered; no match leaves it without an owner.
Layer Asset Manufacturer & Model Firmware Source
BMC gpu-node-01 · BMC Dell iDRAC9 6.10.30.00 Redfish
BMC gpu-node-02 · BMC HPE iLO 6 iLO 6 v1.10 Redfish
BMC gpu-node-03 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.03.12 Redfish
BMC gpu-node-04 · BMC Dell iDRAC9 5.00.00.00 Redfish
BMC gpu-node-05 · BMC Dell iDRAC9 7.10.50.00 Redfish
BMC gpu-node-06 · BMC HPE iLO 6 iLO 6 v1.55 Redfish
BMC gpu-node-07 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.04.02 Redfish
BMC gpu-node-08 · BMC Dell iDRAC9 4.40.00.00 Redfish
BMC gpu-node-09 · BMC Dell iDRAC9 7.20.30.00 Redfish
BMC gpu-node-10 · BMC HPE iLO 6 iLO 6 v1.62 Redfish
BMC gpu-node-11 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.02.15 Redfish
BMC gpu-node-12 · BMC Dell iDRAC9 6.10.30.00 Redfish
BMC gpu-node-13 · BMC Dell iDRAC9 5.00.00.00 Redfish
BMC gpu-node-14 · BMC HPE iLO 6 iLO 6 v1.73 Redfish
BMC gpu-node-15 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.03.12 Redfish
BMC gpu-node-16 · BMC Dell iDRAC9 7.10.50.00 Redfish
BMC gpu-node-17 · BMC Dell iDRAC9 4.40.00.00 Redfish
BMC gpu-node-18 · BMC HPE iLO 6 iLO 6 v1.10 Redfish
BMC gpu-node-19 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.04.02 Redfish
BMC gpu-node-20 · BMC Dell iDRAC9 7.20.30.00 Redfish
BMC gpu-node-21 · BMC Dell iDRAC9 6.10.30.00 Redfish
BMC gpu-node-22 · BMC HPE iLO 6 iLO 6 v1.55 Redfish
BMC gpu-node-23 · BMC Supermicro AMI MegaRAC SP-X (AST2600) 01.02.15 Redfish
BMC gpu-node-24 · BMC Dell iDRAC9 5.00.00.00 Redfish
Power supply gpu-node-01 · PSU 1 Delta DPS-3200AB (3200 W) 00.01.01 Redfish
Power supply gpu-node-01 · PSU 2 Delta DPS-3200AB (3200 W) 00.01.02 Redfish
Power supply gpu-node-02 · PSU 1 Artesyn CSU1800AP (1800 W) 00.02.01 Redfish
Power supply gpu-node-02 · PSU 2 Artesyn CSU1800AP (1800 W) 00.02.02 Redfish
Power supply gpu-node-03 · PSU 1 Delta DPS-3200AB (3200 W) 00.03.01 Redfish
Power supply gpu-node-03 · PSU 2 Delta DPS-3200AB (3200 W) 00.03.02 Redfish
Power supply gpu-node-04 · PSU 1 Artesyn CSU1800AP (1800 W) 00.04.01 Redfish
Power supply gpu-node-04 · PSU 2 Artesyn CSU1800AP (1800 W) 00.04.02 Redfish
Power supply gpu-node-05 · PSU 1 Delta DPS-3200AB (3200 W) 00.05.01 Redfish
Power supply gpu-node-05 · PSU 2 Delta DPS-3200AB (3200 W) 00.05.02 Redfish
Power supply gpu-node-06 · PSU 1 Artesyn CSU1800AP (1800 W) 00.06.01 Redfish
Power supply gpu-node-06 · PSU 2 Artesyn CSU1800AP (1800 W) 00.06.02 Redfish
Power supply gpu-node-07 · PSU 1 Delta DPS-3200AB (3200 W) 00.07.01 Redfish
Power supply gpu-node-07 · PSU 2 Delta DPS-3200AB (3200 W) 00.07.02 Redfish
Power supply gpu-node-08 · PSU 1 Artesyn CSU1800AP (1800 W) 00.08.01 Redfish
Power supply gpu-node-08 · PSU 2 Artesyn CSU1800AP (1800 W) 00.08.02 Redfish
Power supply gpu-node-09 · PSU 1 Delta DPS-3200AB (3200 W) 00.00.01 Redfish
Power supply gpu-node-09 · PSU 2 Delta DPS-3200AB (3200 W) 00.00.02 Redfish
Power supply gpu-node-10 · PSU 1 Artesyn CSU1800AP (1800 W) 00.01.01 Redfish
Power supply gpu-node-10 · PSU 2 Artesyn CSU1800AP (1800 W) 00.01.02 Redfish
Power supply gpu-node-11 · PSU 1 Delta DPS-3200AB (3200 W) 00.02.01 Redfish
Power supply gpu-node-11 · PSU 2 Delta DPS-3200AB (3200 W) 00.02.02 Redfish
Power supply gpu-node-12 · PSU 1 Artesyn CSU1800AP (1800 W) 00.03.01 Redfish
Power supply gpu-node-12 · PSU 2 Artesyn CSU1800AP (1800 W) 00.03.02 Redfish
Power supply gpu-node-13 · PSU 1 Delta DPS-3200AB (3200 W) 00.04.01 Redfish
Power supply gpu-node-13 · PSU 2 Delta DPS-3200AB (3200 W) 00.04.02 Redfish
Power supply gpu-node-14 · PSU 1 Artesyn CSU1800AP (1800 W) 00.05.01 Redfish
Power supply gpu-node-14 · PSU 2 Artesyn CSU1800AP (1800 W) 00.05.02 Redfish
Power supply gpu-node-15 · PSU 1 Delta DPS-3200AB (3200 W) 00.06.01 Redfish
Power supply gpu-node-15 · PSU 2 Delta DPS-3200AB (3200 W) 00.06.02 Redfish
Power supply gpu-node-16 · PSU 1 Artesyn CSU1800AP (1800 W) 00.07.01 Redfish
Power supply gpu-node-16 · PSU 2 Artesyn CSU1800AP (1800 W) 00.07.02 Redfish
Power supply gpu-node-17 · PSU 1 Delta DPS-3200AB (3200 W) 00.08.01 Redfish
Power supply gpu-node-17 · PSU 2 Delta DPS-3200AB (3200 W) 00.08.02 Redfish
Power supply gpu-node-18 · PSU 1 Artesyn CSU1800AP (1800 W) 00.00.01 Redfish
Power supply gpu-node-18 · PSU 2 Artesyn CSU1800AP (1800 W) 00.00.02 Redfish
Power supply gpu-node-19 · PSU 1 Delta DPS-3200AB (3200 W) 00.01.01 Redfish
Power supply gpu-node-19 · PSU 2 Delta DPS-3200AB (3200 W) 00.01.02 Redfish
Power supply gpu-node-20 · PSU 1 Artesyn CSU1800AP (1800 W) 00.02.01 Redfish
Power supply gpu-node-20 · PSU 2 Artesyn CSU1800AP (1800 W) 00.02.02 Redfish
Power supply gpu-node-21 · PSU 1 Delta DPS-3200AB (3200 W) 00.03.01 Redfish
Power supply gpu-node-21 · PSU 2 Delta DPS-3200AB (3200 W) 00.03.02 Redfish
Power supply gpu-node-22 · PSU 1 Artesyn CSU1800AP (1800 W) 00.04.01 Redfish
Power supply gpu-node-22 · PSU 2 Artesyn CSU1800AP (1800 W) 00.04.02 Redfish
Power supply gpu-node-23 · PSU 1 Delta DPS-3200AB (3200 W) 00.05.01 Redfish
Power supply gpu-node-23 · PSU 2 Delta DPS-3200AB (3200 W) 00.05.02 Redfish
Power supply gpu-node-24 · PSU 1 Artesyn CSU1800AP (1800 W) 00.06.01 Redfish
Power supply gpu-node-24 · PSU 2 Artesyn CSU1800AP (1800 W) 00.06.02 Redfish
Voltage regulator gpu-node-01 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-01 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-02 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-02 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-03 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-03 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-04 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-04 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-05 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-05 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-06 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-06 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-07 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-07 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-08 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-08 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-09 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-09 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-10 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-10 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-11 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-11 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-12 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-12 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-13 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-13 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-14 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-14 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-15 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-15 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-16 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-16 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-17 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-17 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-18 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-18 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-19 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-19 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-20 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-20 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-21 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-21 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-22 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-22 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-23 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-23 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-24 · CPU0 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
Voltage regulator gpu-node-24 · CPU1 VCORE VRM rail Infineon XDPE digital VRM rev 2A n/a Redfish *
GPU baseboard gpu-node-01 NVIDIA HGX H100 8-GPU (HMC) 24.02 Redfish (HMC)
GPU baseboard gpu-node-02 NVIDIA HGX H100 8-GPU (HMC) 24.03 Redfish (HMC)
GPU baseboard gpu-node-03 NVIDIA HGX H100 8-GPU (HMC) 24.04 Redfish (HMC)
GPU baseboard gpu-node-04 NVIDIA HGX H100 8-GPU (HMC) 24.05 Redfish (HMC)
GPU baseboard gpu-node-05 NVIDIA HGX H100 8-GPU (HMC) 24.01 Redfish (HMC)
GPU baseboard gpu-node-06 NVIDIA HGX H100 8-GPU (HMC) 24.02 Redfish (HMC)
GPU baseboard gpu-node-07 NVIDIA HGX H100 8-GPU (HMC) 24.03 Redfish (HMC)
GPU baseboard gpu-node-08 NVIDIA HGX H100 8-GPU (HMC) 24.04 Redfish (HMC)
GPU baseboard gpu-node-09 NVIDIA HGX H100 8-GPU (HMC) 24.05 Redfish (HMC)
GPU baseboard gpu-node-10 NVIDIA HGX H100 8-GPU (HMC) 24.01 Redfish (HMC)
GPU baseboard gpu-node-11 NVIDIA HGX H100 8-GPU (HMC) 24.02 Redfish (HMC)
GPU baseboard gpu-node-12 NVIDIA HGX H100 8-GPU (HMC) 24.03 Redfish (HMC)
GPU baseboard gpu-node-13 NVIDIA HGX H100 8-GPU (HMC) 24.04 Redfish (HMC)
GPU baseboard gpu-node-14 NVIDIA HGX H100 8-GPU (HMC) 24.05 Redfish (HMC)
GPU baseboard gpu-node-15 NVIDIA HGX H100 8-GPU (HMC) 24.01 Redfish (HMC)
GPU baseboard gpu-node-16 NVIDIA HGX H100 8-GPU (HMC) 24.02 Redfish (HMC)
GPU baseboard gpu-node-17 NVIDIA HGX H100 8-GPU (HMC) 24.03 Redfish (HMC)
GPU baseboard gpu-node-18 NVIDIA HGX H100 8-GPU (HMC) 24.04 Redfish (HMC)
GPU baseboard gpu-node-19 NVIDIA HGX H100 8-GPU (HMC) 24.05 Redfish (HMC)
GPU baseboard gpu-node-20 NVIDIA HGX H100 8-GPU (HMC) 24.01 Redfish (HMC)
GPU baseboard gpu-node-21 NVIDIA HGX H100 8-GPU (HMC) 24.02 Redfish (HMC)
GPU baseboard gpu-node-22 NVIDIA HGX H100 8-GPU (HMC) 24.03 Redfish (HMC)
GPU baseboard gpu-node-23 NVIDIA HGX H100 8-GPU (HMC) 24.04 Redfish (HMC)
GPU baseboard gpu-node-24 NVIDIA HGX H100 8-GPU (HMC) 24.05 Redfish (HMC)
GPU gpu-node-01 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-01 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.11 DCGM
GPU gpu-node-02 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-02 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.12 DCGM
GPU gpu-node-03 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-03 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.13 DCGM
GPU gpu-node-04 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-04 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.14 DCGM
GPU gpu-node-05 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-05 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.15 DCGM
GPU gpu-node-06 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-06 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.16 DCGM
GPU gpu-node-07 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-07 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.17 DCGM
GPU gpu-node-08 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-08 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.18 DCGM
GPU gpu-node-09 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-09 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.19 DCGM
GPU gpu-node-10 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-10 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.20 DCGM
GPU gpu-node-11 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-11 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.21 DCGM
GPU gpu-node-12 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-12 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.22 DCGM
GPU gpu-node-13 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-13 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.23 DCGM
GPU gpu-node-14 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-14 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.24 DCGM
GPU gpu-node-15 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-15 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.25 DCGM
GPU gpu-node-16 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-16 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.26 DCGM
GPU gpu-node-17 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-17 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.27 DCGM
GPU gpu-node-18 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-18 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.28 DCGM
GPU gpu-node-19 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-19 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.29 DCGM
GPU gpu-node-20 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-20 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.30 DCGM
GPU gpu-node-21 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-21 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.31 DCGM
GPU gpu-node-22 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-22 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.32 DCGM
GPU gpu-node-23 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-23 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.33 DCGM
GPU gpu-node-24 · GPU 0 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 1 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 2 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 3 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 4 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 5 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 6 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
GPU gpu-node-24 · GPU 7 NVIDIA NVIDIA H100 80GB HBM3 96.00.34 DCGM
CPU gpu-node-01 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A1107 Redfish
CPU gpu-node-01 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A1107 Redfish
CPU gpu-node-02 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1214 Redfish
CPU gpu-node-02 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1214 Redfish
CPU gpu-node-03 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A1321 Redfish
CPU gpu-node-03 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A1321 Redfish
CPU gpu-node-04 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A1428 Redfish
CPU gpu-node-04 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A1428 Redfish
CPU gpu-node-05 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A1535 Redfish
CPU gpu-node-05 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A1535 Redfish
CPU gpu-node-06 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1642 Redfish
CPU gpu-node-06 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1642 Redfish
CPU gpu-node-07 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A1749 Redfish
CPU gpu-node-07 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A1749 Redfish
CPU gpu-node-08 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A1856 Redfish
CPU gpu-node-08 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A1856 Redfish
CPU gpu-node-09 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A1963 Redfish
CPU gpu-node-09 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A1963 Redfish
CPU gpu-node-10 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1A70 Redfish
CPU gpu-node-10 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1A70 Redfish
CPU gpu-node-11 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A1B77 Redfish
CPU gpu-node-11 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A1B77 Redfish
CPU gpu-node-12 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A1C84 Redfish
CPU gpu-node-12 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A1C84 Redfish
CPU gpu-node-13 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A1D91 Redfish
CPU gpu-node-13 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A1D91 Redfish
CPU gpu-node-14 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1E98 Redfish
CPU gpu-node-14 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A1E98 Redfish
CPU gpu-node-15 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A1F05 Redfish
CPU gpu-node-15 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A1F05 Redfish
CPU gpu-node-16 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A2012 Redfish
CPU gpu-node-16 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A2012 Redfish
CPU gpu-node-17 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A2119 Redfish
CPU gpu-node-17 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A2119 Redfish
CPU gpu-node-18 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A2226 Redfish
CPU gpu-node-18 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A2226 Redfish
CPU gpu-node-19 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A2333 Redfish
CPU gpu-node-19 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A2333 Redfish
CPU gpu-node-20 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A2440 Redfish
CPU gpu-node-20 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A2440 Redfish
CPU gpu-node-21 · CPU 0 AMD AMD EPYC 9474F Microcode 0x0A2547 Redfish
CPU gpu-node-21 · CPU 1 AMD AMD EPYC 9474F Microcode 0x0A2547 Redfish
CPU gpu-node-22 · CPU 0 Intel Intel Xeon Platinum 8480+ Microcode 0x0A2654 Redfish
CPU gpu-node-22 · CPU 1 Intel Intel Xeon Platinum 8480+ Microcode 0x0A2654 Redfish
CPU gpu-node-23 · CPU 0 AMD AMD EPYC 9654 Microcode 0x0A2761 Redfish
CPU gpu-node-23 · CPU 1 AMD AMD EPYC 9654 Microcode 0x0A2761 Redfish
CPU gpu-node-24 · CPU 0 Intel Intel Xeon Gold 6430 Microcode 0x0A2868 Redfish
CPU gpu-node-24 · CPU 1 Intel Intel Xeon Gold 6430 Microcode 0x0A2868 Redfish
Rack power R01 · PDU A Raritan Raritan PX4 4.1.0 SNMP
Rack power R01 · PDU B Raritan Raritan PX4 4.2.0 SNMP
Rack power R02 · PDU A Raritan Raritan PX4 4.0.0 SNMP
Rack power R02 · PDU B Raritan Raritan PX4 4.1.0 SNMP
Rack power R03 · PDU A Raritan Raritan PX4 4.2.0 SNMP
Rack power R03 · PDU B Raritan Raritan PX4 4.0.0 SNMP
Rack power R04 · PDU A Raritan Raritan PX4 4.1.0 SNMP
Rack power R04 · PDU B Raritan Raritan PX4 4.2.0 SNMP
Rack power R05 · PDU A Raritan Raritan PX4 4.0.0 SNMP
Rack power R05 · PDU B Raritan Raritan PX4 4.1.0 SNMP
Rack power R06 · PDU A Raritan Raritan PX4 4.2.0 SNMP
Rack power R06 · PDU B Raritan Raritan PX4 4.0.0 SNMP
Mgmt port oob-sw-01 · Et2 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-02 · Et3 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-03 · Et4 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-04 · Et5 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-05 · Et6 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-06 · Et7 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-07 · Et8 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-08 · Et9 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-09 · Et10 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-10 · Et11 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-11 · Et12 Arista Arista 7010TX 4.31.2F LLDP · gNMI
Mgmt port oob-sw-12 · Et13 Arista Arista 7010TX 4.31.2F LLDP · gNMI

See the fleet without an agent. Add the agent where you need milliseconds. Deploy as SaaS, in your cloud, on-prem or air-gapped.  ·  * inferred from sensor/registry, confirmed by the agent.