Technical impact
The NVIDIA Infrastructure Controller for Linux contains a flaw that permits an attacker to externally control the name or path of a file that the controller processes. If unvalidated, this can lead to the controller accessing or executing arbitrary files, which may result in code execution, privilege escalation, data tampering, or denial of service. The weakness aligns with CWE‑73, representing improper handling of user‑controlled file paths.
Affected Systems
NVIDIA Infrastructure Controller for Linux is affected. No specific product versions are listed, so any deployment of this software could be vulnerable until a vendor patch is released.
Risk and Exploitability
The CVSS score of 6.6 indicates moderate severity, and the EPSS score is not provided, leaving the precise exploitation likelihood indeterminate. The vulnerability is not yet listed in the CISA KEV catalog, suggesting limited known exploitation. Based on the description, it is inferred that an attacker needs a way to supply a crafted file name or path to the controller—this could originate from an authenticated user interface or an unauthenticated network endpoint that accepts file metadata. If the controller then performs file operations without enforcing path constraints, the attacker could manipulate privileged files or introduce malicious executables, enabling the impacts described.
