CVE-2026-24185

{
  "id": "CVE-2026-24185",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T19:16:46.410",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges."
    },
    {
      "lang": "es",
      "value": "NVIDIA NVOS para conmutadores de red contiene una vulnerabilidad en el componente de configuración del servidor secure shell (SSH) mientras el modo solo PKA está habilitado, donde un administrador podría habilitar inadvertidamente una ruta de autenticación alternativa. Si no se siguen las mejores prácticas para reemplazar la contraseña predeterminada según lo recomendado por NVIDIA, esta ruta de autenticación alternativa podría conducir a un acceso no autorizado. Un exploit exitoso de esta vulnerabilidad podría conducir a una escalada de privilegios."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "NVOS",
          "defaultStatus": "unaffected",
          "platforms": [
            "GB300"
          ],
          "versions": [
            {
              "version": "0.0 to 25.0.2.4438",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "NVIDIA",
          "product": "NVOS",
          "defaultStatus": "unaffected",
          "platforms": [
            "IBSwitch XDR"
          ],
          "versions": [
            {
              "version": "0.0 to 25.0.2.6077",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T18:40:22.354271Z",
          "id": "CVE-2026-24185",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5817",
      "source": "[email protected]"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24185",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24185",
      "source": "[email protected]"
    }
  ]
}