Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux
The NVIDIA Infrastructure Controller for Linux contains a vulnerability (CWE-295: Improper Certificate Validation) that could allow an attacker on the adjacent network to bypass security checks. A successful exploit could lead to information disclosure, data tampering, or denial of service. The vulnerability requires low privileges to exploit and has a medium severity (CVSS 6.7). No public proof-of-concept or in-the-wild exploitation is currently known. Affected users should apply the security update from NVIDIA.
What to do: Update NVIDIA Infrastructure Controller for Linux to the latest patched version provided by NVIDIA. If immediate patching is not possible, restrict network access to the vulnerable component.
| Product | Affected |
|---|---|
| NVIDIA Infrastructure Controller for Linux | All versions prior to the vendor-supplied patch |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
NVIDIA patches 14 vulnerabilities in its Infrastructure Controller, including a critical CVSS 9.8 hard-coded credentials flaw enabling unauthenticated remote privilege escalation.
NVIDIA patches 14 flaws in Linux Infrastructure Controller, including a critical CVSS 9.8 hardcoded credential issue.
Today 1.6K readers · 2.5K views · 781 reads · all time 189K views