EUVD-2026-61105
GHSA-6mg4-xcv2-5mx2
Severity by source
AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:A for management-plane adjacency requirement; AC:H for dual conditions (PKA-only mode plus default password); PR:N because exploitation leverages default credentials on the alternative path without requiring a pre-existing system account.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.
Articles & Coverage 1
AnalysisAI
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions to be true: first, PKA-only mode must be enabled on the NVOS SSH server - this is the specific configuration trigger that inadvertently activates the alternative authentication channel; second, the default device password must not have been replaced per NVIDIA's best-practice hardening guidance - the alternative path is only useful to an attacker if a known or guessable credential remains valid. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 base score reflects a meaningful but operationally constrained risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a foothold on the management VLAN - for example, via a compromised server or lateral movement from an operational network - scans for SSH-accessible NVIDIA NVOS switches. Identifying a device where PKA-only mode has been enabled but the default password was never rotated, the attacker authenticates via the inadvertently enabled password authentication path using the known default credentials, bypassing the PKA enforcement entirely and landing a privileged session on the switch. … |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5817 for any available patched NVOS release - no specific fixed version number was confirmed from the provided references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, rotate all default administrative credentials on affected NVIDIA NVOS network switches per vendor hardening guidance and restrict SSH management access to trusted administrative networks using firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today