NVIDIA Infrastructure Controller for Linux contains a flaw that permits an attacker to bypass certificate validation when establishing TLS connections. This improper validation can enable the attacker to intercept confidential data, modify messages in transit, or disrupt the controller’s operations, leading to information disclosure, data tampering, and denial of service as outlined in the CVE description.

The vulnerability affects NVIDIA Infrastructure Controller for Linux. Version information is not specified in the CNA data, so all installations of this product prior to an available fix are potentially impacted.

The CVSS score of 6.7 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation to date. The likely attack vector is a remote attacker able to present a forged or self‑signed certificate during a TLS handshake with the controller; because the system accepts the certificate, the attacker can read, alter, or terminate traffic. No additional dependencies or authentication requirements are stated in the public data. The risk remains moderate until a patch or mitigation is applied.