Dell PowerEdge Server BIOS (privilege management): An improper privilege-management flaw in PowerEdge BIOS

Impact

An improper privilege-management flaw in PowerEdge BIOS that an unauthenticated local attacker can use to escalate. 'Unauthenticated local' is the sharp part: it does not require a valid OS login, so a tenant with any code execution path on the box, or someone with brief physical access during a rack move or RMA, can reach it. The prize is the firmware layer - an implant there sits below the hypervisor, survives reimaging and disk replacement, and is invisible to every host-level agent you run.

Who can reach it

Local to the host with no authentication required - a tenant workload that escapes its boundary, a technician with console access during maintenance, or anyone with the box open. Does not touch the management VLAN at all, so OOB network segmentation buys you nothing here.

What to do

System BIOS update, which is materially more expensive than a BMC flash: the payload can be staged out-of-band through iDRAC or OME, but it only applies on the next host reboot. That means draining running training jobs, or waiting for a natural maintenance window - realistically a scheduled rolling campaign across the fleet, not a same-day fix. Version floors differ per platform; take them from the advisory's per-model table. No config-only mitigation.

References