NVIDIA Infrastructure Controller Hit by 14 Flaws Enabling Code Execution and Privilege Escalation
NVIDIA patches 14 vulnerabilities in its Infrastructure Controller, including a critical CVSS 9.8 hard-coded credentials flaw enabling unauthenticated remote privilege escalation.
NVIDIA released version 2.0 of its Infrastructure Controller to patch 14 vulnerabilities in its Linux-based management software. The most severe flaw, CVE-2026-65113, is a critical hard-coded credentials vulnerability with a CVSS score of 9.8 that allows unauthenticated remote attackers to escalate privileges, modify data, and disrupt services. The update also addresses high-severity issues like SQL injection (CVE-2026-65128) and missing authentication (CVE-2026-65114), among others affecting versions 0 through 1.9.
- NVIDIA Infrastructure Controller version 2.0 patches 14 vulnerabilities, including a critical hard-coded credentials flaw (CVE-2026-65113, CVSS 9.8).
- Vulnerabilities allow for code execution, privilege escalation, data manipulation, denial of service, and information disclosure.
- The critical flaw can be exploited remotely without authentication.
- Affected versions are 0 through 1.9; users are advised to update from GitHub.
- CVEs
- CVE-2026-65113CVE-2026-65128CVE-2026-65114CVE-2026-65121CVE-2026-65130CVE-2026-65118CVE-2026-65129CVE-2026-65125CVE-2026-65115CVE-2026-65112CVE-2026-65124CVE-2026-65126CVE-2026-65117CVE-2026-65127
- Vendors
- NVIDIA
- Products
- NVIDIA Infrastructure Controller
- Organizations
- NVIDIA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65113 | Hard-Coded Credentials in NVIDIA Infrastructure Controller for Linux | 9.8 group max | — |
From the original article
2 min read at gbhackers.com
NVIDIA has released version 2. 0 of its Infrastructure Controller to address 14 vulnerabilities found in its Linux-based infrastructure management software. This update includes a critical flaw involving hard-coded credentials and multiple issues that could allow for code execution, privilege escalation, data manipulation, denial of service, and information disclosure.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.