Database/Firmware, BMC & network fabric
Perle IOLAN STS/SCS terminal server (firmware before 6.0): A logged-in user of the restricted admin shell (Telnet
Impact
A logged-in user of the restricted admin shell (Telnet or SSH) can break out of that shell and run arbitrary OS commands as root. The 'ps' subcommand doesn't sanitize its arguments before handing them to a shell, so an operator account that was only supposed to have limited diagnostic access ends up with full root on the terminal server.
Who can reach it
Requires an authenticated login to the restricted shell (any account that can reach the 'ps' command), then injects shell metacharacters after the subcommand.
What to do
Firmware upgrade to 6.0 or later — this is a shell-sanitization bug in the restricted-admin feature, not something a permission change alone fixes. Flash each terminal server one at a time; expect a brief loss of the serial sessions it's terminating during the reboot.
References
Related entries
- Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boards: Crafted characters injectedCVE-2026-3820 · Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boardsHigh
- Dell OMSA: high-privileged remote user escalates beyond their assigned OMSA roleCVE-2026-81445 · Dell OpenManage Server Administrator (privilege management, admin-level)High
- Dell OMSA: remote heap overflow gives code execution to a high-privileged accountCVE-2026-81477 · Dell OpenManage Server Administrator (remote heap-based buffer overflow)High
- Dell OMSA: remote stack overflow gives code execution to a high-privileged accountCVE-2026-81480 · Dell OpenManage Server Administrator (stack-based buffer overflow)High
- Intel CSME / Converged Security and Management Engine (mask ROM): A flaw in the CSME boot ROM window before memoryCVE-2019-0090 · Intel CSME / Converged Security and Management Engine (mask ROM)High
- Dell iDRAC9 (web interface, local file inclusion): A path-traversal / local-file-inclusion flaw lets a low-privilegeCVE-2020-5366 · Dell iDRAC9 (web interface, local file inclusion)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.