🚨Critical - AMD Device Metrics Exporter Unrestricted IP Binding (CVE-2026-0481) Unrestricted IP address binding in the AMD Device Metrics Exporter (part of the ROCm ecosystem) exposes the gRPC server (port 50061) and ZeroMQ service (port 6601) on all network interfaces by default. This allows unauthenticated remote attackers to access the service and perform unauthorized changes to GPU configuration. The flaw can result in loss of availability and potential disruption of GPU operations in HPC/AI environments (CVSS 9.2 Critical). 👉Affected: AMD Device Metrics Exporter (ROCm 7.0.x & 7.1.x prior to fixed versions)
Post summary
AMD Device Metrics Exporter exposes its gRPC and ZeroMQ services over all interfaces, enabling unauthenticated remote attackers to alter GPU settings; the vulnerability is rated CVSS 9.2 Critical with no patch or evidence of exploitation yet.
