EUVD-2026-61104
GHSA-577q-25hp-pjhg
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only L2 attack vector, no auth required per LLDP protocol design, high complexity due to memory layout precision; full CIA impact on switch OS if successful.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.
Articles & Coverage 1
AnalysisAI
Remote code execution is possible in NVIDIA Cumulus Linux via its LLDP daemon, exploitable by an unauthenticated attacker positioned on an adjacent network segment. Sending crafted LLDP frames triggers a classic buffer overflow (CWE-120) in the daemon, with successful exploitation yielding full code execution on the affected network device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on a network segment adjacent to the target - meaning the same L2 broadcast domain, directly connected link, or VLAN - since LLDP operates below IP and frames are not routed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H captures the core tension in this vulnerability: while impact is maximal (full CIA triad compromise), the attack vector is constrained to adjacent network (AV:A) and complexity is rated High (AC:H), substantially limiting the realistic attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a network segment adjacent to a Cumulus Linux switch - such as a co-located server, a compromised host on the same VLAN, or a rogue device connected to a trunk port - crafts malformed LLDP frames with oversized or malformed TLV fields designed to overflow a buffer in the LLDPD process. If the overflow reliably overwrites control-flow data such as a return address or function pointer, the attacker achieves arbitrary code execution in the context of the LLDP daemon, potentially with elevated privileges on the switch OS. … |
| Remediation | The primary remediation is to apply any patch or updated release published by NVIDIA for Cumulus Linux. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all NVIDIA Cumulus Linux devices in production and map their network connectivity to identify exposure to untrusted or semi-trusted segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cumulus Linux Ga
View allSame weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today