Technical impact
NVIDIA’s Infrastructure Controller for Linux contains a hard‑coded password that an attacker can exploit to authenticate as an administrator. The flaw is classified as CWE‑259. Once authenticated, the attacker can alter data, disrupt service, and expose sensitive information, impacting confidentiality, integrity, and availability of the controller.
Affected Systems
The vulnerability affects the NVIDIA Infrastructure Controller for Linux. No specific version constraints are listed, so all releases of the controller are potentially vulnerable until a vendor release addresses the issue. The product is commonly deployed to manage NVIDIA infrastructure across virtual or physical hosts.
Risk and Exploitability
The CVSS score of 5 indicates medium severity. EPSS data is unavailable, so the probability of exploitation could not be quantified. The vulnerability is not listed in CISA KEV, implying no known exploitation at time of reporting. The likely attack vector is local or network access to the controller, inferred from the nature of the hard‑coded credential. A successful exploit would grant administrative control, enabling data tampering, denial of service, and information disclosure.
