EUVD-2026-84417
GHSA-p55v-42rh-35pg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Hard-coded credential provides remote unauthenticated access to a full-control management interface (PR:N, C/I/A:H); AC:L accepted since the embedded secret is static and reusable once known.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
3DescriptionCVE.org
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.
Articles & Coverage 4
AnalysisAI
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated remote attacker who possesses the embedded secret log in to the controller's management interface and obtain full control, resulting in privilege escalation, data tampering, denial of service, and information disclosure; the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-798). Because the embedded credential itself is the authentication mechanism, no pre-existing account is required, but practical exploitation depends on the controller being network-reachable and on the attacker extracting or knowing the hard-coded value from the firmware/image or documented defaults. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the NVIDIA Infrastructure Controller for Linux management/service interface (versions 0 through 1.9) and possession of the hard-coded credential embedded in the product - recoverable via reverse-engineering the binary/firmware/image or from documented defaults. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) presents this as a maximally severe unauthenticated network flaw, and CWE-798 (hard-coded credentials) is consistent with PR:N because the embedded credential IS the authentication - an attacker who possesses it does not need to bypass a login. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or exact fixed version is identified in the available data at time of analysis, so the immediate step is to consult the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 (and the CVE/NVD records) for the authoritative fix release and to upgrade the controller to the first patched version NVIDIA publishes for the 0-1.9 range as soon as it is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of NVIDIA Infrastructure Controller for Linux to confirm which instances run versions 0 through 1.9, and treat every confirmed instance as fully compromised in terms of trust: isolate the management interface from any network reachable by untrusted users, restrict access to a dedicated, tightly segmented management VLAN with allow-listed administrative hosts, and enforce strong network-layer authentication and monitoring on those paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today