A vulnerability in the NVIDIA DGX Spark GB10 hardware resources allows an attacker to tamper with hardware controls, potentially leading to unauthorized data access or denial of service.

This is an improper privilege management flaw (CWE-269) located within hardware resources. The CVSS vector indicates this attack can be performed locally by an unauthenticated actor.

The ability to tamper with hardware controls poses a severe risk to the integrity and availability of the system. Successful exploitation could lead to sensitive information disclosure, unauthorized data modification, or a complete denial of service, justifying the high severity CVSS score of 8.0.

Immediate Action: Apply the vendor-supplied security update to version OTA0 or later immediately to address the privilege management flaw.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes or attempts to interact with hardware control interfaces.

Compensating Controls: Ensure physical access to the affected hardware is strictly controlled and restricted to authorized personnel to prevent local exploitation vectors.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for hardware-level control tampering, organizations utilizing the NVIDIA DGX Spark GB10 must prioritize patching. Update all instances to version OTA0 or higher to mitigate the risk of data compromise or system instability. Following the update, perform a thorough audit of system access controls to ensure no unauthorized persistence mechanisms were established prior to the patch.