Technical impact
The vulnerability resides in NVIDIA Infrastructure Controller for Linux, where an attacker can exercise a critical function without proper authentication. This missing authentication (CWE‑306) can lead to unauthorized modification of data, disruption of services, and unauthorized disclosure of information.
Affected Systems
NVIDIA Infrastructure Controller running on Linux is affected. Specific version details were not provided in the advisory, so all installations of this product on Linux should be considered vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 8.3 categorizes the issue as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. The exploit would likely involve access to the controller’s management interface; however, the exact attack vector is not detailed in the advisory and is therefore inferred from the nature of the impacted function. Precautionary mitigation should assume that an attacker with network or local access could potentially bypass authentication.
