NVIDIA UFM Enterprise Session Key Information Disclosure

Executive Summary

This vulnerability in NVIDIA UFM Enterprise involves a hard-coded cryptographic key in the session management component. An attacker could exploit this to extract sensitive information, potentially leading to information disclosure and privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-24166 requires checking for affected versions of NVIDIA UFM Enterprise software. Verify if your system runs UFM Enterprise versions prior to 6.24.1-5 (GA), 6.23.20-3 (LTS 2025), 6.19.15 (LTS 2024), or 6.15.17 (LTS 2023). Use commands like 'ufm version' or check installed packages via package managers (e.g., 'dpkg -l | grep ufm' for Debian-based systems).

Inspect logs for unusual session activity or cryptographic key usage. Monitor network traffic for unauthorized access attempts to UFM services. Ensure no hard-coded keys are present in configuration files or binaries.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive data or gain higher privileges in the system. This may compromise confidentiality and allow unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in NVIDIA UFM Enterprise involves a hard-coded cryptographic key that could allow attackers to extract sensitive information and escalate privileges. This could lead to unauthorized access to personal or health data, which may violate GDPR (General Data Protection Regulation) due to insufficient protection of personal data, and HIPAA (Health Insurance Portability and Accountability Act) if health-related data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Update NVIDIA UFM Enterprise to versions GA 6.24.1-5 or later, LTS 2025 6.23.20-3 or later, LTS 2024 6.19.15 or later, or LTS 2023 6.15.17 or later to address the hard-coded cryptographic key issue.

Useful 0 Not Useful 0