Device Metrics Exporter CVE-2026-0481

Exploitation requires network reachability to the host running the AMD Device Metrics Exporter and the exporter binding to an unrestricted (wildcard) IP address, which exposes its configuration-capable interface beyond localhost; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against affected DME versions on AMD Instinct MI210/MI250/MI250X/MI300A/MI300X/MI308X/MI325X/MI350X/MI355X GPUs. Limiting factors: the target must actually be an AMD Instinct GPU host running a vulnerable DME build (pre-v1.4.1.2 / pre-v1.4.0.1), and the DME listener must be reachable from the attacker's position - instances confined to an isolated management VLAN or bound to localhost are effectively out of reach, sharply reducing practical exploitability despite the high base score.

The signals are partially conflicting and should be weighed carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:H) justifies the 9.2 score through fully remote, unauthenticated, low-complexity access with high availability impact on both the vulnerable and subsequent system - consistent with the 'Authentication Bypass' tag and the wildcard-binding root cause. However, the exploitation-side signals temper urgency: EPSS is only 0.20% (42nd percentile), there is no CISA KEV listing, no public POC, and SSVC records Exploitation as 'none' with Technical Impact only 'partial' (not total). SSVC does flag Automatable: yes, meaning that if exploitation is developed it could be scripted across many exposed instances. Net: this is a genuinely high-severity design flaw where real-world risk hinges almost entirely on network exposure - internet- or broad-LAN-exposed DME instances are a real priority to patch, whereas instances already confined to an isolated management network face substantially lower practical risk. Note the SSVC 'partial' technical impact is slightly softer than the CVSS 'VA:H', so treat impact as availability degradation up to denial rather than assured total compromise.

An attacker on a network segment that can route to an AMD Instinct GPU host discovers the Device Metrics Exporter listening on all interfaces and connects to it without any credentials. Leveraging the unrestricted binding and lack of authentication, the attacker submits configuration changes to the GPU, disrupting or halting running AI/HPC workloads and causing loss of availability. No public exploit code is identified at time of analysis, but the low attack complexity and network-facing exposure make opportunistic abuse of misconfigured/exposed hosts plausible.