EUVD-2026-84420
GHSA-5cf5-vqr7-mf95
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network reachable service (AV:A) with a static embedded credential gives unauthenticated, low-complexity access enabling data tampering, DoS, and disclosure, hence C/I/A:H.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
AnalysisAI
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated attacker who can reach the device from an adjacent network segment log in with embedded, static credentials, resulting in high confidentiality, integrity, and availability impact (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the password is static across installations and recoverable by anyone who can inspect the binary or firmware image, exploitation requires no user interaction and no prior authentication, but it does require the attacker to reside on the same broadcast or management network segment rather than the open internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires adjacent-network access (CVSS AV:A) - the attacker must reside on the same broadcast/management network segment as the NVIDIA Infrastructure Controller for Linux, not the open internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8) rates this high because a hard-coded password (CWE-259) yields full C/I/A compromise with no authentication and low complexity - but the attack vector is Adjacent (AV:A), not Network, meaning the attacker must be on the same logical/physical network segment as the Infrastructure Controller, which materially narrows real-world exposure versus a true internet-facing flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Remediation is to upgrade NVIDIA Infrastructure Controller for Linux beyond version 1.9 to a fixed release, per the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879; because the hard-coded password cannot be rotated on affected builds (it is compiled into the product), upgrading the firmware is the only durable fix and the exact patched version should be confirmed against that bulletin before rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA Infrastructure Controller for Linux deployments running versions 0 through 1.9, move them to dedicated management VLANs, and enforce firewall/ACL rules that deny all unnecessary inbound traffic from adjacent or broadcast domains; enable authentication logging and alerting for embedded or default credential use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today