CVE-2026-24185 in NVOS
Summary
by MITRE • 08/18/2026
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within the Network Operating System (NVOS) SSH server configuration component specifically when Public Key Authentication is exclusively enabled. This architectural oversight allows for an unintended alternative authentication path that bypasses the intended restriction, effectively creating a backdoor if default credentials remain active. The vulnerability stems from incomplete validation of authentication methods during the initialization phase of the secure shell service, where the system fails to strictly enforce the PKA-only constraint when legacy password-based mechanisms are still present in the configuration database but not explicitly disabled at the protocol level. This design defect means that while the administrator intends to restrict access solely to users with valid cryptographic keys, the underlying implementation retains a fallback mechanism for standard username and password authentication if specific hardening steps are omitted.
The operational impact of this vulnerability is significant as it directly compromises the integrity of remote management interfaces on NVIDIA network switches. An attacker who possesses knowledge or guesses of default administrative credentials can exploit this alternative path to gain unauthorized access to the device shell. This initial foothold typically results in low-privilege user access, but given that these are often high-level administrative accounts with broad system permissions, a successful exploitation event frequently leads to privilege escalation. Once elevated privileges are obtained, an adversary can execute arbitrary commands, modify network configurations, exfiltrate sensitive data, or use the compromised switch as a pivot point for further lateral movement within the enterprise infrastructure. This scenario is particularly dangerous in environments where default passwords have not been rotated according to NVIDIA’s recommended security best practices, leaving critical infrastructure exposed to automated scanning tools and opportunistic attacks.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify identity before granting access through an unintended channel. It also relates to CWE-16 Configuration, indicating that the flaw is rooted in how security settings are applied or validated during configuration rather than a pure code logic error. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain access, and potentially T1546 Event Triggered Execution if the authentication bypass triggers specific background processes that can be manipulated for persistence or command execution. The vulnerability underscores the critical importance of not only enabling strong authentication methods but also ensuring that legacy mechanisms are completely disabled at the configuration level to prevent fallback behaviors.
Mitigation strategies must focus on strict adherence to NVIDIA’s security hardening guidelines, which explicitly require changing default passwords and disabling all non-PKA authentication methods in the SSH server configuration files. Administrators should audit their switch configurations to ensure that password-based login is fully prohibited for both local and remote access attempts. Additionally, implementing network-level controls such as IP allow-listing for management interfaces can provide a defense-in-depth layer, limiting exposure even if the software vulnerability were exploited. Regular security audits and automated configuration compliance checks are recommended to detect any deviation from the PKA-only policy before it can be leveraged by malicious actors. Keeping firmware updated is also essential, as NVIDIA may release patches that address this implementation flaw in future releases of NVOS.