CVE-2024-0113

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-12 · updated 2026-06-17
Weakness: CWE-35

Description

NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.

Affected products

NVIDIA Mlnx-Gw: before 8.1.4500; before 8.2.2300 — fixed in 8.1.4500, 8.2.2300
NVIDIA Mlnx-Os: before 3.10.4500; before 3.12.1002; from 3.11.0000 before 3.11.2302 — fixed in 3.10.4500, 3.11.2302, 3.12.1002
NVIDIA Nvda-Os Xc: before 18.2.2200 — fixed in 18.2.2200
NVIDIA ONYX: before 3.10.4504 — fixed in 3.10.4504

How to fix

Upgrade to a fixed version: NVIDIA Mlnx-Gw 8.1.4500, 8.2.2300; NVIDIA Mlnx-Os 3.10.4500, 3.11.2302, 3.12.1002; NVIDIA Nvda-Os Xc 18.2.2200; NVIDIA ONYX 3.10.4504. Check the vendor advisory for mitigations.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5563

Get alerted when CVE-2024-0113 or the next vulnerability affects your stack