EUVD-2026-84414
GHSA-3w47-qr97-2jcc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQLi needing only low-privilege auth (PR:L, AC:L, UI:N); vendor-claimed code execution and DoS justify full C:H/I:H/A:H, though A:H is slightly generous for SQLi.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
3DescriptionCVE.org
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
Articles & Coverage 3
AnalysisAI
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network access to the NVIDIA Infrastructure Controller management interface plus valid low-privilege authenticated credentials (CVSS PR:L) - it is NOT exploitable fully unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority-worthy vulnerability, though not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed by the available data: no fixed version number is provided and the references point only to the NVIDIA product security advisory page (https://github.com/NVIDIA/product-security/tree/main/2026/5879), which should be consulted for the vendor-released update that supersedes the affected 0-1.9 range - check that advisory before assuming a workaround is sufficient. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of NVIDIA Infrastructure Controller for Linux versions 0 through 1.9, restrict management interface access to trusted networks via firewall rules or VPN, and enable detailed logging to detect SQL injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today