CVE-2024-0113 is a high severity (CVSS 7.5) CGI path traversal in the web support of NVIDIA Mellanox OS, ONYX, Skyway and MetroX switches. A specially crafted URI can trigger it. NVIDIA fixed it in releases such as Mellanox OS 3.12.1002 and ONYX LTS 3.10.4504.
What's affected
NVIDIA bulletin 5563 lists these affected versions (up to and including) and fixed versions:
- Mellanox OS: up to 3.11.4000, fixed in 3.12.1002
- Mellanox OS LTS: up to 3.11.2200, fixed in 3.11.2302; and up to 3.10.4400, fixed in 3.10.4500
- ONYX LTS: up to 3.10.4400, fixed in 3.10.4504
- Skyway: up to 8.2.2200, fixed in 8.2.2300; Skyway LTS up to 8.1.4400, fixed in 8.1.4500
- MetroX-3 XC: up to 18.2.2200, fixed in 18.2.2300
- MetroX-2: up to 3.11.4000, fixed in 3.12.1002
Earlier releases are also affected, so NVIDIA advises moving to the latest release.
How to check if you're exposed
Check the version on each switch.
show version
Then check whether the web management interface is enabled and who can reach it. The flaw is in web support, so a switch with the web interface turned off or limited to a management network is in a better position, though you should still upgrade.
What to do now
- Inventory switches and their software versions.
- Upgrade to the fixed release for each product line, or to the latest.
- Disable the web interface where it is not needed, and limit access to a dedicated management network.
- Review access logs of the web interface for unusual requests.
Why it matters
The record lists CWE-22, path traversal, and CWE-35, a traversal that uses a path with directory components. The web server's CGI handling accepts a path that can point outside the folder it should serve from. NVIDIA lists escalation of privileges and information disclosure as impacts.
The vector is network, no privileges, but high complexity and user interaction required, giving 7.5. Management interfaces of network gear should not be exposed to untrusted networks in any case. The record does not mark the CVE as exploited in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Is the web interface the only exposure?
The flaw is in the web support component, so that is the exposed surface.
Which release fixes it?
It depends on the product line. See the table above and NVIDIA bulletin 5563.
Sources
Last reviewed: 19 October 2026.
