EUVD-2026-84411
GHSA-jmch-6h6h-g3p5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management controller with low-privilege authentication (PR:L); attacker-controlled path in a high-privilege process yields full code execution, so C/I/A all High.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.
AnalysisAI
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the NVIDIA Infrastructure Controller (AV:N) plus low-privilege authenticated access (PR:L) - it is not a fully unauthenticated attack despite the RCE tag. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a low-privileged but remotely reachable flaw with total technical impact (C:H/I:H/A:H), consistent with the CWE-73 external-control-of-path root cause and the described consequences (code execution, privilege escalation, data tampering, DoS). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or specific fixed version is identified in the provided data, so the primary action is to consult the NVIDIA product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 for the release that corrects CVE-2026-65125 and upgrade NVIDIA Infrastructure Controller on Linux to that build as soon as it is published, cross-checking against the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-65125 and the CVE.org entry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of NVIDIA Infrastructure Controller for Linux versions 0 through 1.9 and restrict network access to trusted management VLANs or jump hosts; enforce multi-factor authentication and least privilege for all accounts with access to the controller; enable audit logging and monitor for anomalous file path operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today