Dell Terraform Provider for Redfish: TLS verification disabled, exposing BMC credentials to MITM

Impact

The provider's base HTTP transport disables TLS certificate verification unconditionally, so every Redfish call it makes to a BMC can be intercepted and modified by anyone positioned on the path. Operators use this provider to drive server lifecycle at fleet scale - BIOS settings, boot order, firmware updates, power state, user accounts - so the intercepted traffic carries BMC administrator credentials in the clear to the attacker. Those credentials are usually shared or templated across a rack or a whole GPU fleet, which turns one captured session into management-plane access to many nodes. An attacker who can also alter responses can feed false state back to Terraform or steer a firmware or boot change, and BMC-level control of a GPU node is below the hypervisor and the tenant.

Who can reach it

Anyone able to intercept traffic between the host running Terraform and the BMCs on the management network - typically the management VLAN or anything in the routed path to it. No authentication is needed; the attacker only needs the network position, since the client never checks whose certificate it is talking to.

What to do

Upgrade the Dell Terraform Provider for Redfish to 1.6.2 or later and re-run the configuration from a trusted host. No node reboot or firmware flash is involved - this is a client-side module upgrade on the automation host. Because any credential that traversed an unverified session may have been captured, treat BMC accounts used by this provider as exposed and rotate them, and keep Redfish traffic on a management network that is not shared with tenant or general-purpose traffic.

References

Related entries

• Arista EOS OSPFv3: crafted packet restarts the routing agentCVE-2026-73455 · Arista EOS (OSPFv3 routing agent)High
• Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c): The canonical RDMA isolationCVE-2014-8159 · Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c)High
• Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injection: A string injection escapes theCVE-2016-5685 · Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injectionHigh
• Cisco NX-OS / FXOS (LLDP parser): A malformed LLDP frame reloads the switch. LLDP is enabled by default on essentiallyCVE-2018-0395 · Cisco NX-OS / FXOS (LLDP parser)High
• Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent): Command injection in the iDRAC SNMP agent gives an attacker who alreadyCVE-2018-1244 · Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent)High
• Dell iDRAC9 (Redfish): Redfish interface permission-check flaw enabling privilege escalation to adminCVE-2018-15774 · Dell iDRAC9 (Redfish)High