Dell OpenManage Enterprise: SQL injection reachable by a low-privileged remote user

Impact

OpenManage Enterprise before 4.7.0 fails to neutralize special elements in a SQL command, and Dell states a low-privileged remote attacker could exploit it, leading to script injection. OME is the console that inventories, configures and firmware-updates an entire iDRAC fleet, so its database holds the credentials and the reach to touch every server in the hall — a low-privileged account gaining read access there is a foothold into out-of-band management, which sits on a network most tenants never see and most operators trust implicitly. Dell's own scoring puts confidentiality high with limited availability impact and no integrity loss. The record does not describe a confirmed remote code execution path, only SQL injection leading to script injection.

Who can reach it

Remote attacker holding a low-privileged OpenManage Enterprise account, reaching the OME web interface — in most datacenters that means anyone with a console login on the management VLAN. Authentication is required.

What to do

Upgrade the OpenManage Enterprise appliance to 4.7.0 per Dell advisory DSA-2026-359; the appliance restarts, which takes the management console offline briefly but does not touch the managed servers. Until the upgrade, confirm the OME interface is reachable only from the management network and review which accounts hold low-privileged console logins.

References