Technical impact
The vulnerability is an XML injection flaw in NVIDIA Infrastructure Controller for Linux. An attacker can insert malicious XML content into configuration or communication payloads, allowing tampering with stored data and potentially causing the controller to crash, resulting in denial of service. The weakness is classified as CWE‑91, representing an XML injection flaw that can alter application behavior.
Affected Systems
NVIDIA Infrastructure Controller for Linux is impacted. The issue exists in the current version(s) of the product. No revision numbers are provided, so all current releases should be assumed vulnerable until a vendor‑supplied fix is available.
Risk and Exploitability
The CVSS v3.1 score for this vulnerability is 5.9, indicating a moderate risk level. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed yet. The likely attack vector is via the controller’s XML processing interfaces; attack conditions probably require network reachability to the controller and the ability to send crafted XML payloads. Because the flaw does not grant code execution or privileged access, the potential impact is confined to data integrity and availability for the affected system.
