PT-2024-15350 · Nvidia · Metrox-3 Xcc+2

Cyrille Chatras · Published 2024-08-09 · Updated 2025-02-12 · CVE-2024-0113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC (affected versions not specified)

Description The vulnerable software contains a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

CWE-424

CWE-35

Related Identifiers

BDU:2025-09219

CVE-2024-0113

ZDI-24-1333

Affected Products

Metrox-3 Xcc

Nvidia Mellanox Os

Onyx

References · 13

• https://zerodayinitiative.com/advisories/ZDI-24-1333 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-0113 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0113 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09219 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0113 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5563 · Vendor Advisory
• https://twitter.com/cracbot/status/1823238142012576089 · Twitter Post
• https://twitter.com/cracbot/status/1823962879160410607 · Twitter Post
• https://twitter.com/cracbot/status/1824325273732649004 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1844090332918563116 · Twitter Post
• https://security.paloaltonetworks.com/CVE-2024-0113 · Note
• https://twitter.com/cracbot/status/1823600485598945494 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823004206187319407 · Twitter Post