CVE-2024-0101 is a high severity (CVSS 7.5) denial of service flaw in the ipfilter of NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC. Improper ipfilter definitions could let an attacker cause the switch to fail. NVIDIA fixed it in release lines such as Mellanox OS 3.11.2002 and later.
What's affected
NVIDIA bulletin 5559 lists these affected versions (up to and including) and fixed versions:
- Mellanox OS: up to 3.11.1000, fixed in 3.11.2002
- ONYX LTS: up to 3.10.4300, fixed in 3.10.4402
- Skyway: up to 8.2.1000, fixed in 8.2.2000
- Skyway LTS: up to 8.1.4300, fixed in 8.1.4400
- MetroX-3 XC: up to 18.2.1000, fixed in 18.2.2000
- MetroX-2: up to 3.11.1000, fixed in 3.11.2002
The bulletin also says earlier releases are affected and advises upgrading to the latest release.
How to check if you're exposed
Read the software version from the switch command line.
show version
Compare the product line and version to the table above. Also review the ipfilter configuration on each switch, since the flaw involves ipfilter definitions. Keep a copy of the current configuration before you upgrade, in line with NVIDIA upgrade guidance.
What to do now
- List all Mellanox OS, ONYX, Skyway and MetroX switches and their versions.
- Upgrade to the fixed release for each product line, or to the latest release.
- Review ipfilter rules and restrict management access to trusted networks.
- Plan the upgrade window, since a switch reboot affects traffic.
Why it matters
The record classes this as CWE-693, protection mechanism failure. A control that should protect the device, here the ipfilter, does not behave as intended, and that can be used to make the switch fail. The only listed impact is denial of service, and the vector is network, low complexity, with no privileges needed.
Availability matters on switches that carry storage or compute traffic, because a single failing device can take down a rack. The record does not mark it as exploited in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Does this affect only one product?
No. The bulletin lists Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC, each with its own fixed release.
Is data at risk?
NVIDIA lists denial of service as the impact for this CVE.
Sources
Last reviewed: 19 October 2026.
