NVIDIA Cumulus Linux and NVOS Hashed Password Logging Vulnerability

A vulnerability exists in NVIDIA Cumulus Linux and NVOS products, where hashed user passwords are not adequately suppressed in log files. This oversight could lead to unauthorized disclosure of information. The issue is present in Cumulus Linux versions 5.12, 5.11, 5.10, 5.9 and older, as well as NVOS 25.02.21xx, 25.02.22xx, 25.02.23xx, and 25.02.3xxx.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure.

Remediation

Users are advised to update to the latest versions of Cumulus Linux or NVOS, both of which include a fix for this vulnerability. Additionally, it is recommended to review log files for any sensitive information that may have been inadvertently logged and to ensure that logs are sanitized if extracted from the system.