Intel Ethernet Controller E810 firmware: An unauthenticated attacker on the network can take an E810 NIC out of service

Impact

An unauthenticated attacker on the network can take an E810 NIC out of service through a protection-mechanism failure in the adapter firmware. E810 is the standard 100/200GbE front-end NIC on a large share of AI servers, and it is often also the storage-network NIC — so knocking it down removes the node from both the job and its dataset. Because the fault is in firmware, the host OS sees a dead link, not a driver problem, and normal remediation (restart the driver) does not recover it.

Who can reach it

Unauthenticated, remote — traffic arriving at the NIC over the network. No host credentials and no adjacency requirement.

What to do

Flash E810 adapter firmware to 4.4 or later using Intel's NVM Update Tool (or the OEM-repackaged version — Dell DSA-2025-236, HPE and Lenovo ship their own). NVM updates require a **cold power cycle**, not a warm reboot, for the new image to take effect — so this is a full node drain per server, which across a GPU fleet is the dominant cost. Sequence it with your normal node-maintenance rotation rather than as an emergency.

References