Infrastructure Controller
Monthly
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who occupies an on-path / man-in-the-middle position on the controller's network path to present a forged, mismatched, or otherwise invalid certificate that the product wrongly accepts, enabling information disclosure, data tampering, and denial of service. NVIDIA's advisory assigns a 9.8 CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but independent assessment lowers the real-world severity to AV:N/AC:H because the attacker must first intercept or redirect the controller's TLS traffic, and CISA's SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial. No public exploit has been identified at time of analysis, EPSS is 0.13% (3rd percentile), and there is no CISA KEV listing, so the practical risk is confined to environments where an adversary can influence the network path between the controller and its TLS peers.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated attacker who can reach the device from an adjacent network segment log in with embedded, static credentials, resulting in high confidentiality, integrity, and availability impact (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the password is static across installations and recoverable by anyone who can inspect the binary or firmware image, exploitation requires no user interaction and no prior authentication, but it does require the attacker to reside on the same broadcast or management network segment rather than the open internet. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.23% (14th percentile), with CISA SSVC rating exploitation as "none" and the attack as not automatable.
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows remote, unauthenticated attackers to reach a privileged operation without credentials, enabling data tampering, denial of service, and information disclosure. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the independent assessment concurs, meaning no authentication, no user interaction, and no special complexity are required against a network-reachable instance; the practical limiting factor is exposure, since this is a specialized AI/HPC datacenter management component usually confined to internal management networks. There is no public exploit identified at time of analysis and EPSS is low at 0.41% (35th percentile), though CISA SSVC rates technical impact as partial and automatable exploitation as 'no'; the specific critical function lacking authentication is not named in the available data.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated remote attacker who possesses the embedded secret log in to the controller's management interface and obtain full control, resulting in privilege escalation, data tampering, denial of service, and information disclosure; the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-798). Because the embedded credential itself is the authentication mechanism, no pre-existing account is required, but practical exploitation depends on the controller being network-reachable and on the attacker extracting or knowing the hard-coded value from the firmware/image or documented defaults. There is no public exploit identified at time of analysis and the product is not listed in CISA KEV, though the specialized datacenter/DPU infrastructure-management role of this component means exposure is typically limited to segmented management networks rather than the public internet.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session and sits on the same adjacent network segment to man-in-the-middle controller TLS connections, leading to information disclosure, data tampering, and denial of service. The flaw is rated CVSS 7.6 (AV:A/AC:L/PR:L/UI:N, C:H/I:H/A:L) and there is no public exploit code identified at time of analysis, no CISA KEV listing, and an EPSS score of only 0.13% (3rd percentile), consistent with a genuine but moderate, non-urgent risk. Exploitation is constrained by the requirements for adjacency (not internet-reachable) and prior low-privilege authentication, so the realistic attacker set is narrow.
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is remotely reachable without user interaction and any authenticated, network-exposed instance in the affected range should be treated as priority-worthy rather than emergency-level, given the authentication prerequisite and the niche datacenter/DPU deployment footprint.
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated low-privilege user on the management plane drive the product's API with out-of-order or state-skipping requests that defeat intended workflow checks, with possible data tampering, denial of service, and information disclosure. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus the ability to craft non-sequential workflow calls, and SSVC records Exploitation as 'none' and Automatable as 'no', so there is no public exploit identified at time of analysis. EPSS is low at 0.31% (24th percentile), and our independent assessment rates the practical severity below the vendor's 8.8 because the assessed vector is AC:H with only low confidentiality, integrity, and availability impact.
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is a low 0.61% (48th percentile), so near-term mass exploitation is unlikely even though technical impact is total (C:H/I:H/A:H).
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session to corrupt data and degrade availability by feeding crafted input into the product's XML handling. The flaw is network-reachable (AV:N), needs no user interaction (UI:N), and leaves confidentiality untouched (C:N), with the full impact landing on integrity and availability (I:H/A:H); the practical exposure is narrowed because valid credentials are mandatory, the target is a specialized NVIDIA datacenter infrastructure component, and SSVC rates the issue non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis, EPSS places exploitation likelihood at roughly 0.5% (43rd percentile), and there is no CISA KEV listing - this is a genuine medium-to-high priority fix, not an emergency.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who already holds valid low-privilege credentials on the controller can trigger uncontrolled resource consumption that degrades or halts the service (CWE-400). The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a remotely reachable flaw with low attack complexity and no user interaction, but impact is confined to availability - there is no data disclosure or modification. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, so real-world risk is bounded primarily by the requirement for authenticated access to the controller.
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-privileged user with network reach to the management interface exhaust resources and degrade or halt the controller. The flaw is a CWE-400 uncontrolled resource consumption issue rated vendor CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact, no confidentiality or integrity loss, low attack complexity, and no user interaction, with the credential requirement being the principal barrier to exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, no EPSS score was provided, and the exact triggering request or feature is not disclosed in the vendor description.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who occupies an on-path / man-in-the-middle position on the controller's network path to present a forged, mismatched, or otherwise invalid certificate that the product wrongly accepts, enabling information disclosure, data tampering, and denial of service. NVIDIA's advisory assigns a 9.8 CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but independent assessment lowers the real-world severity to AV:N/AC:H because the attacker must first intercept or redirect the controller's TLS traffic, and CISA's SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial. No public exploit has been identified at time of analysis, EPSS is 0.13% (3rd percentile), and there is no CISA KEV listing, so the practical risk is confined to environments where an adversary can influence the network path between the controller and its TLS peers.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated attacker who can reach the device from an adjacent network segment log in with embedded, static credentials, resulting in high confidentiality, integrity, and availability impact (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the password is static across installations and recoverable by anyone who can inspect the binary or firmware image, exploitation requires no user interaction and no prior authentication, but it does require the attacker to reside on the same broadcast or management network segment rather than the open internet. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.23% (14th percentile), with CISA SSVC rating exploitation as "none" and the attack as not automatable.
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows remote, unauthenticated attackers to reach a privileged operation without credentials, enabling data tampering, denial of service, and information disclosure. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the independent assessment concurs, meaning no authentication, no user interaction, and no special complexity are required against a network-reachable instance; the practical limiting factor is exposure, since this is a specialized AI/HPC datacenter management component usually confined to internal management networks. There is no public exploit identified at time of analysis and EPSS is low at 0.41% (35th percentile), though CISA SSVC rates technical impact as partial and automatable exploitation as 'no'; the specific critical function lacking authentication is not named in the available data.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated remote attacker who possesses the embedded secret log in to the controller's management interface and obtain full control, resulting in privilege escalation, data tampering, denial of service, and information disclosure; the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-798). Because the embedded credential itself is the authentication mechanism, no pre-existing account is required, but practical exploitation depends on the controller being network-reachable and on the attacker extracting or knowing the hard-coded value from the firmware/image or documented defaults. There is no public exploit identified at time of analysis and the product is not listed in CISA KEV, though the specialized datacenter/DPU infrastructure-management role of this component means exposure is typically limited to segmented management networks rather than the public internet.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session and sits on the same adjacent network segment to man-in-the-middle controller TLS connections, leading to information disclosure, data tampering, and denial of service. The flaw is rated CVSS 7.6 (AV:A/AC:L/PR:L/UI:N, C:H/I:H/A:L) and there is no public exploit code identified at time of analysis, no CISA KEV listing, and an EPSS score of only 0.13% (3rd percentile), consistent with a genuine but moderate, non-urgent risk. Exploitation is constrained by the requirements for adjacency (not internet-reachable) and prior low-privilege authentication, so the realistic attacker set is narrow.
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is remotely reachable without user interaction and any authenticated, network-exposed instance in the affected range should be treated as priority-worthy rather than emergency-level, given the authentication prerequisite and the niche datacenter/DPU deployment footprint.
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated low-privilege user on the management plane drive the product's API with out-of-order or state-skipping requests that defeat intended workflow checks, with possible data tampering, denial of service, and information disclosure. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus the ability to craft non-sequential workflow calls, and SSVC records Exploitation as 'none' and Automatable as 'no', so there is no public exploit identified at time of analysis. EPSS is low at 0.31% (24th percentile), and our independent assessment rates the practical severity below the vendor's 8.8 because the assessed vector is AC:H with only low confidentiality, integrity, and availability impact.
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is a low 0.61% (48th percentile), so near-term mass exploitation is unlikely even though technical impact is total (C:H/I:H/A:H).
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session to corrupt data and degrade availability by feeding crafted input into the product's XML handling. The flaw is network-reachable (AV:N), needs no user interaction (UI:N), and leaves confidentiality untouched (C:N), with the full impact landing on integrity and availability (I:H/A:H); the practical exposure is narrowed because valid credentials are mandatory, the target is a specialized NVIDIA datacenter infrastructure component, and SSVC rates the issue non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis, EPSS places exploitation likelihood at roughly 0.5% (43rd percentile), and there is no CISA KEV listing - this is a genuine medium-to-high priority fix, not an emergency.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who already holds valid low-privilege credentials on the controller can trigger uncontrolled resource consumption that degrades or halts the service (CWE-400). The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a remotely reachable flaw with low attack complexity and no user interaction, but impact is confined to availability - there is no data disclosure or modification. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, so real-world risk is bounded primarily by the requirement for authenticated access to the controller.
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-privileged user with network reach to the management interface exhaust resources and degrade or halt the controller. The flaw is a CWE-400 uncontrolled resource consumption issue rated vendor CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact, no confidentiality or integrity loss, low attack complexity, and no user interaction, with the credential requirement being the principal barrier to exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, no EPSS score was provided, and the exact triggering request or feature is not disclosed in the vendor description.
Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal provided, so this is best treated as a post-compromise information-gathering weakness rather than an initial-access threat.