NVIDIA DGX OS Security Update Notice for MSI EdgeXpert Users - CVE-2026-24218

Dear MSI EdgeXpert users:

NVIDIA has published a security bulletin for NVIDIA DGX Spark regarding CVE-2026-24218, a vulnerability related to the factory provisioning process in NVIDIA DGX OS.
According to NVIDIA, systems provisioned from the same base image may contain duplicated SSH host keys and system machine identifiers, which could enable host impersonation or attacker-in-the-middle attacks. NVIDIA rates this issue as High severity with a CVSS v3.1 base score of 8.1.

MSI EdgeXpert Security Update Status
MSI EdgeXpert introduced NVIDIA DGX OS OTA0 in October 2025. Based on NVIDIA’s security bulletin, this vulnerability affects DGX OS versions prior to OTA0 and is addressed starting from OTA0.
Therefore, MSI EdgeXpert systems updated to OTA0 or later have already received the security update that addresses CVE-2026-24218.
MSI EdgeXpert has continued to align with NVIDIA DGX OS update progress from OTA0, through OTA1 and OTA2, to the current latest MSI EdgeXpert DGX OS release.

Current Recommended Version
MSI recommends users update to the latest DGX OS image available from the official MSI EdgeXpert product support page.
Current MSI EdgeXpert DGX OS image:
- Version: NVIDIA DGX OS OTA2604
- Release Date: 2026-05-19
- MSI EdgeXpert official download page:
https://ipc.msi.com/product_download/Industrial-Computer-Box-PC/AI-Supercomputer/EdgeXpert-MS-C931

Recommended Action
For best system security, stability, and compatibility, MSI recommends all EdgeXpert users keep their systems updated to the latest DGX OS image provided on the MSI EdgeXpert support page.
Before updating:
- Back up important data.
- Ensure the system is connected to stable power.
- Schedule the update during a maintenance window.
- Follow the MSI DGX OS image installation guide provided on the MSI product support page.

Additional Notes for Cloned or Deployed Systems
For systems that have already been deployed or cloned from a golden image, NVIDIA recommends verifying that the following identifiers are unique on each system and do not match the golden image:
- /etc/ssh/ssh_host_ecdsa_key
- /etc/ssh/ssh_host_ecdsa_key.pub
- /etc/ssh/ssh_host_ed25519_key
- /etc/ssh/ssh_host_ed25519_key.pub
- /etc/ssh/ssh_host_rsa_key
- /etc/ssh/ssh_host_rsa_key.pub
- /etc/machine-id

If duplicated identifiers are found, please refer to the NVIDIA security bulletin for the recommended regeneration steps.

References
NVIDIA Security Bulletin: NVIDIA DGX Spark - May 2026
https://nvidia.custhelp.com/app/answers/detail/a_id/5835

Thank you.

MSI EdgeXpert Support Team
 
Click to expand...
Hi MSI EdgeXpert Support Team:
According the download page, the note says:
"3. The BSP version must be paired with EC9310N1MSI.401A0.bin and GOP 9000C60."
In my EdgExpert's BIOS, firmware version of GOP is 9000B90.
Can I apply this OTA?

Others info,
(1) DGX dashboard >> Updates >> your device is up to date
(2) the login message of EdgExpert is:
Welcome to NVIDIA DGX Spark Version 7.5.0 (GNU/Linux 6.17.0-1021-nvidia aarch64)
 

Attachments

  • EdgExpert_firmware_info.jpg
    EdgExpert_firmware_info.jpg
    397.4 KB · Views: 36
novaymevo157802e5 said:
Hi MSI EdgeXpert Support Team:
According the download page, the note says:
"3. The BSP version must be paired with EC9310N1MSI.401A0.bin and GOP 9000C60."
In my EdgExpert's BIOS, firmware version of GOP is 9000B90.
Can I apply this OTA?

Others info,
(1) DGX dashboard >> Updates >> your device is up to date
(2) the login message of EdgExpert is:
Welcome to NVIDIA DGX Spark Version 7.5.0 (GNU/Linux 6.17.0-1021-nvidia aarch64)
Click to expand...
Hi,

Thank you for your inquiry and for providing the system information.
Yes, you may proceed with this OTA update. Please refer to the official OS Installation Guide on MSI IPC website for image preparation and OTA update procedures.
Regarding the firmware versions and update process, please refer to the following:
  1. * During the OS installation OOBE process, when the system performs updates, the related firmware components will be automatically updated through LVFS.
  2. * After entering the OS, please check DGX Dashboard >> Updates to confirm whether additional updates are available. If updates are shown, please proceed with updating the system to the
  3. latest available version.
  4. * After completing the updates, you may verify the firmware information by running the following command:
  5. sudo dmidecode -t 45
  6. This command can be used to confirm the current firmware versions and update status.
Please let us know the verification results or if you have any further questions.

Thank you.

Best regards
MSI EdgeXpert Support Team
 
Athrun said:
Hi,

Thank you for your inquiry and for providing the system information.
Yes, you may proceed with this OTA update. Please refer to the official OS Installation Guide on MSI IPC website for image preparation and OTA update procedures.
Regarding the firmware versions and update process, please refer to the following:
  1. * During the OS installation OOBE process, when the system performs updates, the related firmware components will be automatically updated through LVFS.
  2. * After entering the OS, please check DGX Dashboard >> Updates to confirm whether additional updates are available. If updates are shown, please proceed with updating the system to the
  3. latest available version.
  4. * After completing the updates, you may verify the firmware information by running the following command:
  5. sudo dmidecode -t 45
  6. This command can be used to confirm the current firmware versions and update status.
Please let us know the verification results or if you have any further questions.

Thank you.

Best regards
MSI EdgeXpert Support Team
Click to expand...
Thank you for your reply. The update process went smoothly on both machines.
 
Back
Top