NuClide Research
Most recent
↑↓ navigate ↵ open esc close Corpus index built 2026-06-07 23:58 UTC

← All engagement records

Case study May 1, 2026

National Taiwan University: GPU Cluster g1pc2n108, Multimodal Vision Stack

Bill Rondell, Nick Adams & Dade Murphy — May 1, 2026 — case study — 2 min read — 535 words
Sector
Universities
Country
ntu

NuClide Research · 2026-05-01

Summary

NTU’s GPU cluster node g1pc2n108.g1.ntu.edu.tw (140.112.233.108) has Ollama exposed on port 11434 with 11 models skewed heavily toward vision and multimodal tasks, including GLM-OCR, GLM-4.7-Flash, MiniCPM-V, LLaVA, and llama3.2-vision.

Infrastructure

FieldValue
IP140.112.233.108
Hostnameg1pc2n108.g1.ntu.edu.tw
OrganizationNational Taiwan University, GPU Cluster 1, Node 108
NetworkTaiwan MOE TANet (140.112.0.0/16)
CountryTaiwan
Open ports11434 (Ollama, public)

Model Inventory

ModelSizeCategory
glm-4.7-flash:latest17GBZhipuAI GLM-4.7 vision-language
glm-ocr:latest2GBZhipuAI OCR model (1.1B params)
llama3.2-vision:latest7GBMeta vision-language
minicpm-v:latest5GBMiniCPM-V multimodal
llava:7b4GBLLaVA vision-language
moondream:latest1GBLightweight vision model
qwen3.5:latest6GBText LLM
llama3.2:3b1GBSmall LLM
llama3.2:latest1GB,
llama3:latest4GB,
qwen:latest2GB,

Findings

F1: Unauthenticated Inference on University GPU Cluster (HIGH)

All 11 models are publicly accessible without authentication. The heavy multimodal/vision focus, GLM-4.7-Flash, GLM-OCR, LLaVA, MiniCPM-V, moondream, llama3.2-vision, indicates this node serves active vision research or document processing workflows.

GLM-OCR (glm-ocr:latest) is a specialized optical character recognition model. Any documents being processed through this pipeline are accessible to unauthenticated callers.

F2: CVE-2025-63389 Injectable (HIGH)

All 11 models injectable via unauthenticated /api/create.

Node: pc214.ee.ntu.edu.tw (140.112.18.214): 5G Security Research

ModelSystem PromptNotes
qwen3.5-nothinker:latest”You are a 5G network security expert. Respond directly without internal reasoning. /no_think”Custom research model
qwen3.5-std:latest,Standard variant (comparison)
qwen3.5:27b,Base model
qwen3:8b,,
smollm2:135mDefault SmolLM prompt,

The system prompt on qwen3.5-nothinker:latest, "You are a 5G network security expert. Respond directly without internal reasoning. /no_think", identifies this as an NTU EE department node conducting 5G network security research. The /no_think flag suppresses the model’s chain-of-thought, indicating the operator wants direct answers for a specific research workflow. CVE-2025-63389 can overwrite this prompt, hijacking the 5G security research pipeline.

Node: 140.112.183.119: Custom Coder + MiniMax Cloud

FieldValue
IP140.112.183.119
Hostname, (no rDNS)
Version0.22.1
Open port11434 (public)
ModelNotes
mdq100/qwen3.5-coder:35bCustom coding model, non-standard namespace, operator-built
minimax-m2.7:cloud☁️ Cloud proxy, account takeover surface

mdq100/qwen3.5-coder:35b is a non-Ollama-Hub model (HuggingFace-style user/repo namespace) running a customized Qwen3.5 Coder 35B variant. The operator namespace mdq100 is not resolvable to a published HF repo, likely a private fine-tune or modified weights. Paired with a live MiniMax M2.7 cloud proxy; the 401 response exposes an Ollama Connect claim URL.

Node: 140.112.91.82: Custom Assistant + MiniMax Cloud

FieldValue
IP140.112.91.82
Hostname, (no rDNS)
Version,
Open port11434 (public)
ModelNotes
qwen3-assistant:latestCustom model, operator-named assistant persona
minimax-m2.7:cloud☁️ Cloud proxy, account takeover surface

qwen3-assistant:latest is a custom-named model with operator-defined system prompt (persona: generic assistant). The name suggests a Qwen3 base with assistant role fine-tuning or system prompt customization. Cloud proxy exposure same as 140.112.183.119.

NTU Footprint

NodeIPHostnameVersionNotes
GPU Cluster 1 Node 108140.112.233.108g1pc2n108.g1.ntu.edu.tw0.19.0Vision stack (GLM-OCR, LLaVA, MiniCPM-V)
EE PC-214140.112.18.214pc214.ee.ntu.edu.tw0.17.75G security research, custom models
NTU Node 183.119140.112.183.119,0.22.1mdq100/qwen3.5-coder:35b custom + minimax cloud
NTU Node 91.82140.112.91.82,,qwen3-assistant custom + minimax cloud
NTU Node 249.176140.112.249.176407-2.m7.ntu.edu.tw0.22.1embeddinggemma:300m (RAG embedding only)

Remediation

OLLAMA_HOST=127.0.0.1:11434
systemctl restart ollama

Disclosure

  • Discovered: 2026-05-01
  • Status: Pending outreach to NTU CERT (140.112.0.0/16, csirt@ntu.edu.tw)