NVIDIA Infrastructure Controller for Linux has a flaw that permits OS command injection, which can be leveraged to execute arbitrary code, modify data, disrupt service availability, and expose sensitive information. The weakness is a classic command injection vulnerability identified as CWE-78, allowing attackers to interact with the operating system shell through improper input sanitization. Successful exploitation would grant the attacker full control over the target system, effectively compromising confidentiality, integrity, and availability.

The affected product is NVIDIA Infrastructure Controller, a Linux‑based management platform from NVIDIA. No specific version information is provided in the report, indicating that multiple or unknown releases may be impacted.

With a CVSS score of 8.0 the vulnerability is considered high severity. The EPSS score is 2%, and it is not listed in the CISA KEV database, providing no confirmed exploitation evidence in 2026. Based on the description, the likely attack vector is remote, through network‑exposed controller interfaces; however, the exact prerequisites are not detailed. The high severity combined with the capability for remote code execution represents a significant risk to affected deployments.