EUVD-2026-84415
GHSA-m58f-7v99-qrxg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Adjacent MITM (AV:A) with low-privilege auth (PR:L); improper cert validation enables high confidentiality/integrity loss and limited availability impact, matching vendor 7.6.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
AnalysisAI
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session and sits on the same adjacent network segment to man-in-the-middle controller TLS connections, leading to information disclosure, data tampering, and denial of service. The flaw is rated CVSS 7.6 (AV:A/AC:L/PR:L/UI:N, C:H/I:H/A:L) and there is no public exploit code identified at time of analysis, no CISA KEV listing, and an EPSS score of only 0.13% (3rd percentile), consistent with a genuine but moderate, non-urgent risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an adjacent-network (AV:A) position - the attacker must be on the same logical/physical network segment as the NVIDIA Infrastructure Controller, not the open internet - plus low-privilege authenticated access (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a genuine but moderate, non-urgent risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was specified in the provided data, so confirm the fixed build in NVIDIA's product-security advisory (https://github.com/NVIDIA/product-security/tree/main/2026/5879) and upgrade Infrastructure Controller off the 0-1.9 range to that release; the advisory should be checked before assuming any particular version is remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every NVIDIA Infrastructure Controller for Linux instance and confirm which are running versions 0 through 1.9, then restrict management-plane access to these controllers using strict ACLs and dedicated VLANs so that no low-privilege users or general-purpose hosts share the adjacent network segment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today