NVIDIA DGX BMC (AMI firmware): Hard-coded credentials in the DGX BMC firmware

Impact

Hard-coded credentials in the DGX BMC firmware. Anyone who can reach the BMC's management interface authenticates with credentials baked into a firmware image that is publicly downloadable - meaning no credential rotation on your side ever helped. That is full out-of-band control of a DGX-1 or DGX-2: power, console, virtual media, and a path to reflashing the host. Affects DGX-1 before BMC 3.38.30 and DGX-2 before 1.06.06.

Who can reach it

Anyone with network reach to the BMC. If the management network is flat, shared with tenants, or accidentally routable, that is effectively anyone inside the datacenter - and internet-exposed BMCs make it anyone at all.

What to do

Flash the DGX BMC firmware from NVIDIA's DGX firmware update container (DGX-1 to 3.38.30 or later, DGX-2 to 1.06.06 or later; DGX A100 per the bulletin's table). A BMC flash does not require the host OS to reboot but drops out-of-band management for several minutes and NVIDIA recommends a host power cycle afterwards, so treat it as a per-node maintenance window. Rotate every BMC and IPMI credential after the flash - flashing does not invalidate secrets an attacker already pulled. Keep BMCs on an isolated management VLAN with no route from tenant or job networks.

References