Dell iDRAC Service Module (iSM) for Windows and Linux: Improper access control in the host-side iDRAC Service Module

Impact

Improper access control in the host-side iDRAC Service Module lets a low-privilege local user escalate on the host. iSM is the agent that bridges the operating system to the iDRAC over the internal USB-NIC / passthrough channel, so it is the component that deliberately crosses the host-to-BMC boundary. Escalating through it gets an attacker host-level privilege and puts them next to a channel that talks to the service processor - the pivot direction that turns a tenant workload compromise into an out-of-band one. Affects iSM for Windows before 6.0.3.1 and iSM for Linux before 5.4.1.1.

Who can reach it

Host-side, local, low privilege - a tenant workload or any account on the operating system where iSM is installed. Not reachable from the management VLAN; the exposure is entirely inside the host.

What to do

Upgrade the iSM package on the host to 6.0.3.1 (Windows) or 5.4.1.1 (Linux) or later. This is a host-side package update and a service restart, not a firmware flash - no host reboot in the normal case, so no job drain. Config-only alternative worth considering on nodes that do not need it: uninstall iSM entirely, or disable the iDRAC host USB-NIC passthrough (iDRAC Settings > OS to iDRAC Pass-through), which removes the host-to-BMC channel at the cost of in-band iDRAC access and some OS-level telemetry.

References