NVIDIA DGX Spark: UEFI administrator password protection can be bypassed by a privileged local user

CVE-2026-47624Firmware, BMC & network fabriccurated

Impact

A privileged local user on a DGX Spark can bypass the administrator password that is supposed to gate UEFI setup, per NVIDIA's advisory (a CWE-693 protection-mechanism failure). The password exists so that host-level root and firmware-level control stay separate: bypassing it lets someone who already owns the OS also change boot configuration and firmware settings. NVIDIA scores integrity impact high with a scope change and no confidentiality or availability impact, which matches a settings-tampering outcome rather than data theft. Firmware-level settings survive an OS reinstall, so this is the kind of change that outlives whatever cleanup an operator does at the software layer.

Who can reach it

Local access with high privileges already held - effectively an OS administrator or root on the DGX Spark. No network path and no user interaction are described.

What to do

Apply the DGX Spark firmware update from NVIDIA's advisory (product-security bulletin 5867, which also covers CVE-2026-24225); the record here does not name a fixed firmware version. A UEFI update means taking the system out of service for the flash and reboot rather than a live patch. Until then, treat the UEFI password as ineffective against anyone who already holds root, and control who has that.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-47624 https://github.com/NVIDIA/product-security/tree/main/2026/5867 https://www.cve.org/CVERecord?id=CVE-2026-47624

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.