CVE-2024-0104 is a medium severity (CVSS 4.2) improper access flaw in the LDAP AAA component of NVIDIA Mellanox OS, ONYX, Skyway and MetroX switches. A user can gain access they should not have. NVIDIA fixed it in releases such as Mellanox OS LTS 3.11.2202.
What's affected
NVIDIA bulletin 5559 lists these affected versions (up to and including) and fixed versions:
- Mellanox OS LTS: up to 3.11.2100, fixed in 3.11.2202
- ONYX LTS: up to 3.10.4302, fixed in 3.10.4402
- Skyway: up to 8.2.2100, fixed in 8.2.2202
- MetroX-3 XC: up to 18.2.2100, fixed in 18.2.2200
- MetroX-2: up to 3.11.1000, fixed in 3.11.2002
NVIDIA says earlier releases are also affected and advises upgrading to the latest release. The bulletin lists information disclosure, data tampering and escalation of privileges as possible impact.
How to check if you're exposed
Check the version on each switch.
show version
Then check whether the switch uses LDAP for authentication, authorization or accounting. The flaw is in that component, so switches that use local accounts only are less likely to be exposed. Confirm with the bulletin rather than assuming.
What to do now
- Inventory switches and note which ones use LDAP for AAA.
- Upgrade to the fixed release for the product line, or to the latest.
- Review LDAP group mappings so that only intended groups get switch administration rights.
- Check switch logs for unusual logins.
Why it matters
The weakness is CWE-284, improper access control. The LDAP AAA component decides who may log in and what they may do, so a flaw there can give someone more access than the directory intended.
The score is 4.2 because the vector needs high attack complexity and a low privilege account already, with low impacts. That still makes it worth patching in the normal cycle, especially since the same bulletin fixes a higher severity issue, CVE-2024-0101. The record does not show exploitation in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Why is the score only medium?
The NVIDIA vector needs high attack complexity and low privileges, and rates each impact as low.
Which CVE shares this bulletin?
CVE-2024-0101, a high severity ipfilter flaw, is in the same bulletin.
Sources
Last reviewed: 19 October 2026.
