Dell SmartFabric OS10 (hard-coded password): A hard-coded password in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.x

Impact

A hard-coded password in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.x, usable by a low-privileged attacker with remote access. A shipped credential in a switch NOS is identical on every unit in the fleet and on every other customer's fleet, so once it is known there is no per-device secrecy left. CVE-2024-48831 and CVE-2025-36609 are further hard-coded-password findings in the same product, which makes this a pattern rather than an incident.

Who can reach it

Low-privileged attacker with remote access to the switch. In practice any credential that gets you onto the box at all.

What to do

OS10 upgrade plus switch reload. There is no config workaround — you cannot change a hard-coded credential. Until patched, the only real control is making the management interface unreachable from anything but a bastion. Rollout: one reload per switch across the leaf/spine.

References

Related entries

• Dell SmartFabric OS10 (hard-coded password): A hard-coded password in OS10 10.5.6.x gives an unauthenticated attackerCVE-2024-48831 · Dell SmartFabric OS10 (hard-coded password)High
• Insyde InsydeH2O (VariableRuntimeDxe, SecureBootHandler): The Secure Boot variable handler bounds-checks incoming dataCVE-2024-52880 · Insyde InsydeH2O (VariableRuntimeDxe, SecureBootHandler)High
• Intel Xeon 6 with TDX (protected memory range handling): Improper handling of overlap between protected memory rangesCVE-2025-22889 · Intel Xeon 6 with TDX (protected memory range handling)High
• IBM Power Systems Firmware: BMC/FSP root can read and disrupt host processor state across all partitionsCVE-2026-17063 · IBM Power Systems Firmware (BMC/FSP-to-host interface, processor state)High
• TPM 2.0 reference code: leak lets a privileged local user obtain a CA credential for a falsified TPM keyCVE-2026-6726 · TCG TPM 2.0 reference code (attestation credential handling, TCG VRT0010)High
• Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pages: The page-count arithmetic for an RDS RDMA scatter-gatherCVE-2010-3865 · Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pagesHigh