Cumulus Linux Ga
Monthly
Remote code execution is possible in NVIDIA Cumulus Linux via its LLDP daemon, exploitable by an unauthenticated attacker positioned on an adjacent network segment. Sending crafted LLDP frames triggers a classic buffer overflow (CWE-120) in the daemon, with successful exploitation yielding full code execution on the affected network device. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the high-impact CVSS vector (C:H/I:H/A:H) warrants prompt remediation in network infrastructure environments.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
Remote code execution is possible in NVIDIA Cumulus Linux via its LLDP daemon, exploitable by an unauthenticated attacker positioned on an adjacent network segment. Sending crafted LLDP frames triggers a classic buffer overflow (CWE-120) in the daemon, with successful exploitation yielding full code execution on the affected network device. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the high-impact CVSS vector (C:H/I:H/A:H) warrants prompt remediation in network infrastructure environments.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.