CVE-2024-0113

HIGH

8.8

CVSS Score

Published: August 9, 2024 at 02:19 AM UTC

Updated: June 17, 2026 at 06:52 AM UTC

11 products affected across 1 vendorMlnx GwNvda OS XcONYX

Using Mellanox OS by NVIDIA?

Get instant alerts when new vulnerabilities affect Mellanox OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Mlnx Gw · NVIDIA

95%

v < 8.1.4500v < 8.2.2300

Affected range stops below 8.1.4500, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.2300, so it looks safe — our inference, not a vendor statement

nvidia-mga100-hs2 (environment)

Mlnx OS · NVIDIA

95%

v ≤ 3.10.4400v ≤ 3.11.2200v ≤ 3.11.4000v < 3.10.4500v < 3.12.10023.11.0000 ≤ v < 3.11.2302All versions prior to and including 3.10.4400 All versions prior to and including 3.11.2200 All versions prior to and including 3.11.4000

Affected range stops below 3.10.4500, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.11.2302, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.12.1002, so it looks safe — our inference, not a vendor statement

nvidia-tq8100-hs2f (environment) · nvidia-tq8200-hs2f (environment)

Nvda OS Xc · NVIDIA

95%

v < 18.2.2200

Affected range stops below 18.2.2200, so it looks safe — our inference, not a vendor statement

nvidia-mtq8400-hs2r (environment)

ONYX · NVIDIA

95%

v < 3.10.4504

Affected range stops below 3.10.4504, so it looks safe — our inference, not a vendor statement

MetroX-2 · NVIDIA

60%

v ≤ 3.11.4000All versions prior to and including 3.11.4000

MetroX-3 · NVIDIA

60%

v ≤ 18.2.2200All versions prior to and including 18.2.2200

Skyway · NVIDIA

60%

v ≤ 8.1.4400v ≤ 8.2.2200All versions prior to and including 8.1.4400 All versions prior to and including 8.2.2200

Mga100-Hs2 · NVIDIAdevice

80%

All versions

Mtq8400-Hs2R · NVIDIAdevice

80%

All versions

Tq8100-Hs2F · NVIDIAdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://nvidia.custhelp.com/app/answers/detail/a_id/5563

References (1)

Vendor Advisory

Source: [email protected]

https://nvidia.custhelp.com/app/answers/detail/a_id/5563

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-35CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card