An improper factory provisioning process in NVIDIA DGX OS results in duplicated SSH host keys, significantly undermining the security of inter-system communications.

This vulnerability involves the insecure cloning of base images during factory provisioning, which causes multiple systems to share the same SSH host keys. This facilitates Man-in-the-Middle (MitM) attacks by rendering SSH host verification unreliable across the fleet.

With a CVSS score of 8.1, this vulnerability represents a High severity risk. The duplication of cryptographic keys allows adversaries to impersonate legitimate servers, potentially leading to widespread unauthorized access and interception of sensitive administrative traffic within the network.

Immediate Action: Apply the vendor-provided security updates to regenerate unique SSH host keys for all affected DGX OS instances.

Proactive Monitoring: Audit SSH host keys across the infrastructure to identify instances where identical keys are in use.

Compensating Controls: Implement strict network segmentation and utilize centralized key management or configuration management tools to enforce unique identity verification for all hardware nodes.

Public Exploit Available: false

This vulnerability fundamentally breaks the trust model of SSH in affected environments. Organizations must verify their systems for key duplication and apply the necessary vendor patches to ensure unique host identity and secure communication.