CVE-2026-65117

Executive Summary

CVE-2026-65117 is a hard-coded password vulnerability (CWE-259) in NVIDIA Infrastructure Controller for Linux. An attacker with access to the adjacent network segment can exploit the embedded credentials to gain unauthorized access to the controller, potentially resulting in data tampering, denial of service, and information disclosure. The vulnerability carries a CVSS v3.1 base score of 5.0 (Medium), is currently unpatched per all tracked sources, and has no public proof-of-concept, exploit code, or Nuclei template available.

Technical Analysis

The vulnerability class here is CWE-259: Use of Hard-coded Password. This occurs when a software product contains a password or cryptographic key embedded directly in its source code, firmware image, or configuration artifacts, rather than requiring the operator to supply a unique, changeable credential during installation or commissioning.

The affected product is NVIDIA Infrastructure Controller for Linux. Based on the CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), the key technical characteristics are:

• Attack Vector — Adjacent (AV:A): The attacker must be positioned on the same logical network segment or an adjacent one reachable from the target. This is consistent with an infrastructure controller that exposes management or control-plane services on an internal network rather than the public internet. It implies the attacker cannot simply reach the device over the internet and must first obtain a foothold on a physically or logically proximate network.
• Attack Complexity — High (AC:H): Successful exploitation is not a single trivial packet. High complexity suggests the attack depends on conditions outside the attacker's direct control (e.g., a specific service state, a timing window, a particular authentication flow, a required pre-existing configuration) or on knowledge that must be assembled. This is consistent with a hard-coded credential that is only useful against a specific service, interface, or protocol and may be combined with other steps.
• Privileges Required — None (PR:N): The attacker does not need to authenticate first. This aligns directly with CWE-259: the hard-coded password is itself the authentication material, so no prior credential is needed.
• User Interaction — None (UI:N): No victim action is required; the attacker interacts directly with the vulnerable component.
• Scope — Unchanged (S:U): The impact is confined to the same security authority as the vulnerable component.
• Confidentiality / Integrity / Availability — Low (C:L/I:L/A:L): Each impact is limited, not total. This suggests the compromised credential grants access to a bounded set of functions rather than full root-level control of the host, or that the exposed component governs a limited portion of the system. The description confirms all three impact categories: data tampering (I), denial of service (A), and information disclosure (C).

Because the hard-coded password is embedded rather than user-supplied, it cannot be rotated by the operator through normal configuration. Every deployment of the affected component in the affected state shares the same secret, meaning that once the credential is known or extracted, all similarly configured instances become reachable with the same value.

The specific credential, the affected binary or service, the network port, and the exact Linux package version are not disclosed in the available data. The NVD description provides only the class and the impact profile. No affected version range, OSV package version, or vendor advisory identifier was provided in the input, so those specifics cannot be stated without fabrication.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-65117. The attack chain below is inferred strictly from the vulnerability class (CWE-259 hard-coded password) and the CVSS vector, and does not assert any specific function name, endpoint, file path, or parameter, none of which appear in the source data.

1. Reconnaissance and target identification. The attacker obtains a foothold on a network adjacent to the target (consistent with AV:A). Using internal network scanning against services exposed by NVIDIA Infrastructure Controller for Linux, the attacker enumerates reachable management or control interfaces. The attacker correlates discovered services with knowledge that the product contains a hard-coded password.

2. Credential acquisition. Because the password is hard-coded, the attacker does not brute-force it in the classic sense. Instead, the attacker obtains the embedded value by one of the routes typical of CWE-259: extracting it from a firmware image, installer, or package; recovering it from public documentation, source disclosure, or prior research; or reusing a credential already recovered from another instance of the same product. The high attack complexity (AC:H) is consistent with this acquisition step being non-trivial or dependent on access to product artifacts.

3. Authentication using the hard-coded credential. With the embedded password in hand and no prior privileges required (PR:N), the attacker authenticates to the reachable management or control service on the target using the hard-coded credential. No victim user interaction is required (UI:N).

4. Post-exploitation impact. Given the low-but-nonzero impact ratings across all three CIA categories, the attacker can, within the access the credential grants: tamper with data or configuration (integrity), cause the controller or the infrastructure it governs to become unavailable (denial of service), and read information exposed through the authenticated interface (confidentiality). The unchanged scope (S:U) indicates the impact remains within the controller's own security boundary.

The precise service, protocol, and actions available after authentication are not described in the available data and are intentionally not invented here.

Impact Assessment

CVE-2026-65117 affects NVIDIA Infrastructure Controller for Linux. Because the product is an infrastructure controller, compromise can affect the infrastructure components it manages, not only the controller host itself — that is the principal blast-radius concern.

• Business impact: Hard-coded credentials enable unauthorized access that persists as long as the credential remains unchanged — which, by definition of CWE-259, is until a vendor patch removes or randomizes it. Operators cannot remediate by rotating a password. Compromise of an infrastructure controller can translate into tampering with managed systems, service outages, and disclosure of infrastructure topology or configuration data.
• Affected systems: Deployments of NVIDIA Infrastructure Controller for Linux. No version range was provided, so operators must determine exposure directly from the vendor advisory and their installed inventory. Network exposure is the primary gate: systems reachable from an attacker-controlled adjacent network segment are at risk.
• Blast radius: Constrained by AV:A and the Low CIA ratings. An internet-facing attacker cannot exploit this directly; a pivot or existing internal foothold is required. Impact is bounded but real across confidentiality, integrity, and availability.
• CVSS subscores: Base 5.0 Medium — AV:A (reduced from network), AC:H (reduced likelihood), PR:N and UI:N (no preconditions on privileges or victim action), S:U (contained), C/I/A all Low (limited but non-zero per-category damage). The Medium rating reflects meaningful impact gated behind adjacency and a high-complexity exploitation path, not a trivial remote compromise.
• Exploit maturity: No public PoC, no exploit code, no Nuclei template, and not in CISA KEV. EPSS has not yet been scored by FIRST.org, so no probability estimate is asserted. The absence of weaponization lowers near-term urgency but does not eliminate risk: hard-coded credentials are frequently disclosed retroactively and, once published, are trivially reusable against every unpatched instance.

Detection Guidance

Sigma Rule

title: Potential Authentication Using Hard-Coded Credential - NVIDIA Infrastructure Controller
id: 7c9e2a41-3b6d-4f18-9a2e-5d1c8f0b6e21
status: experimental
description: Detects authentication events against NVIDIA Infrastructure Controller for Linux that may indicate use of the hard-coded credential described in CVE-2026-65117. Tune to local log source and field names.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65117
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1078
  - attack.t1552.001
  - cve.2026.65117
logsource:
  product: linux
  service: auth
detection:
  selection_process:
    process|contains:
      - 'nv-infrastructure-controller'
      - 'nv_infrastructure'
  selection_event:
    message|contains:
      - 'authentication failure'
      - 'accepted password'
      - 'login'
  selection_source:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_process and selection_event and selection_source
falsepositives:
  - Legitimate administrative logins from the local network
  - Automated configuration tooling using service accounts
level: medium

YARA Rule

rule CVE_2026_65117_Hardcoded_Password_NVIDIA_Infra_Controller
{
    meta:
        description = "Detects potential hard-coded password artifacts associated with CVE-2026-65117 in NVIDIA Infrastructure Controller for Linux. High false-positive risk; requires analyst review."
        cve = "CVE-2026-65117"
        cwe = "CWE-259"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"

    strings:
        $prod1 = "Infrastructure Controller" ascii wide nocase
        $prod2 = "nvidia" ascii wide nocase
        $cred1 = "password" ascii wide nocase
        $cred2 = "passwd" ascii wide nocase
        $cred3 = "default_password" ascii wide nocase
        $cred4 = "hardcoded" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        ($prod1 or $prod2) and 1 of ($cred*)
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-65117 - Possible Hard-Coded Credential Authentication Attempt Against NVIDIA Infrastructure Controller"; flow:established,to_server; content:"Authorization|3a 20|Basic"; http_header; threshold:type limit, track by_src, count 5, seconds 300; classtype:attempted-admin; reference:cve,2026-65117; sid:2026651170; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-65117 - Repeated Authentication Failures to NVIDIA Infrastructure Controller from Adjacent Network"; flow:established,to_server; content:"Infrastructure Controller"; http_header; pcre:"/Authorization\x3a Basic/"; threshold:type threshold, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-65117; sid:2026651171; rev:1;)

Elastic Detection

sequence by host.id, source.ip with maxspan=10m
  [ authentication where process.name : ("*infrastructure*", "*nvidia*") and event.outcome == "failure" ]
  [ authentication where process.name : ("*infrastructure*", "*nvidia*") and event.outcome == "success" and winlog is null ]

Splunk SPL Query

index=linux sourcetype=linux_secure OR index=network
| search ("Infrastructure Controller" OR "nvidia" OR "infrastructure-controller")
| search ("authentication failure" OR "Accepted password" OR "Accepted publickey" OR "Basic")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, dest_port, action
| where count >= 5
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="nvidia_infrastructure_controller,cve_2026_65117,">
  <rule id="2026651" level="10">
    <decoded_as>syslog</decoded_as>
    <match>Infrastructure Controller</match>
    <regex>authentication failure|failed login|invalid password</regex>
    <description>CVE-2026-65117: Possible hard-coded credential authentication attempts against NVIDIA Infrastructure Controller for Linux</description>
    <mitre>
      <id>T1078</id>
      <id>T1552.001</id>
    </mitre>
    <group>authentication_failures,attempted_admin,</group>
  </rule>

  <rule id="2026652" level="12">
    <decoded_as>syslog</decoded_as>
    <match>Infrastructure Controller</match>
    <regex>Accepted password|login successful|authentication succeeded</regex>
    <description>CVE-2026-65117: Successful authentication to NVIDIA Infrastructure Controller from a non-standard or adjacent-network source - investigate for hard-coded credential reuse</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence, vendor fix version, workaround, or affected-version range was provided by any tracked source. The controls below are compensating measures based on the vulnerability class (CWE-259, hard-coded password), not a remediation of the underlying defect.

1. Immediate mitigations

   • Network-isolate NVIDIA Infrastructure Controller for Linux deployments. Enforce strict segmentation so that the controller is not reachable from general user VLANs, and treat AV:A exposure as the primary risk gate.
   • Restrict management-plane access to dedicated jump hosts with allow-listed source addresses; deny-by-default on all management ports.
   • Monitor for repeated authentication attempts and unexpected successful logins from adjacent subnets (see Detection Guidance). Because the credential is hard-coded and shared, a single successful anomalous login should be treated as a potential compromise, not a false positive.
   • If the product exposes any documented mechanism to override or replace the embedded credential, apply it and rotate all such secrets. Do not assume the hard-coded value can be changed unless the vendor documents a supported method.

2. Patch / upgrade steps

   • Monitor the NVIDIA Product Security portal and the NVD record for CVE-2026-65117 for an authoritative advisory and fixed release. None is available at time of writing.
   • Maintain an accurate inventory of all NVIDIA Infrastructure Controller for Linux installations and their versions so that patching can proceed immediately once a fix is published.
   • Do not deploy the affected component on networks reachable from untrusted or shared segments until a patch exists.

3. Long-term hardening

   • Eliminate dependency on embedded credentials in infrastructure components; where the vendor offers configurable authentication, integrate with centralized identity and enforce unique per-deployment secrets.
   • Adopt a secrets-management standard that prohibits shipping products with non-rotatable credentials, and validate this during procurement.
   • Enforce MFA and certificate-based authentication on all infrastructure management interfaces.
   • Include hard-coded-credential checks (CWE-259) in secure acquisition reviews and firmware/software supply-chain assessment.
   • Retain offline, trusted firmware images for integrity comparison if credential extraction from product artifacts is suspected.

References

• NVD — CVE-2026-65117: https://nvd.nist.gov/vuln/detail/CVE-2026-65117
• MITRE CWE-259 — Use of Hard-coded Password: https://cwe.mitre.org/data/definitions/259.html
• FIRST EPSS — CVE-2026-65117 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-65117
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-65117 not listed; verify current status: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NVIDIA Product Security portal — authoritative vendor advisory expected; consult directly for fixed-version information: https://www.nvidia.com/en-us/security/

No threat actor campaign, exploit-in-the-wild evidence, public proof-of-concept, or Nuclei template was identified for CVE-2026-65117 in the available data. The vulnerability is not listed in CISA KEV and has no EPSS score from FIRST.org at time of writing.