Dell SmartFabric OS10 (hard-coded password): A hard-coded password in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.x

Impact

A hard-coded password in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.x, usable by a low-privileged attacker with remote access. A shipped credential in a switch NOS is identical on every unit in the fleet and on every other customer's fleet, so once it is known there is no per-device secrecy left. CVE-2024-48831 and CVE-2025-36609 are further hard-coded-password findings in the same product, which makes this a pattern rather than an incident.

Who can reach it

Low-privileged attacker with remote access to the switch. In practice any credential that gets you onto the box at all.

What to do

OS10 upgrade plus switch reload. There is no config workaround — you cannot change a hard-coded credential. Until patched, the only real control is making the management interface unreachable from anything but a bastion. Rollout: one reload per switch across the leaf/spine.

References