NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2/MetroX-3 XC: A crafted URI causes CGI path traversal in the switch web

Impact

A crafted URI causes CGI path traversal in the switch web interface, reaching privilege escalation and information disclosure on the switch itself. These are the InfiniBand and Ethernet switches carrying your east-west training traffic and, on MetroX, your inter-site links.

Who can reach it

Network, requires the switch web management interface to be reachable and a user to follow a crafted URI. Switch management planes are usually far more reachable inside the datacenter than operators assume.

What to do

Upgrade the switch OS per bulletin 5563. Cost: a switch OS upgrade means a reboot and a link flap - on a fat-tree fabric plan it leaf-by-leaf with ECMP draining, or you take collective jobs down. Disable the web interface entirely and manage via CLI/gNMI if you can.

References

Related entries

• BIOS firmware on Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT and X11PDG-SN before version 4.4: An arbitrary memoryCVE-2024-36432 · BIOS firmware on Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT and X11PDG-SN before version 4.4High
• NVIDIA Triton Inference Server: An invalid request triggers a divide-by-zero and kills the server processCVE-2025-23321 · NVIDIA Triton Inference ServerHigh
• NVIDIA Triton Inference Server: Cancelling a stream before it is processed causes a double free and crashes the serverCVE-2025-23322 · NVIDIA Triton Inference ServerHigh
• NVIDIA Triton Inference Server: An integer overflow on an invalid request leads to a segmentation faultCVE-2025-23323 · NVIDIA Triton Inference ServerHigh
• NVIDIA Triton Inference Server: A second integer-overflow-to-segfault path on invalid requestsCVE-2025-23324 · NVIDIA Triton Inference ServerHigh
• NVIDIA Triton Inference Server: Crafted input drives uncontrolled recursion and exhausts the stackCVE-2025-23325 · NVIDIA Triton Inference ServerHigh