Dell OpenManage Enterprise: low-privileged remote user can inject SQL into the management console

Impact

OpenManage Enterprise is the console that inventories and drives iDRACs across a server fleet — firmware updates, BIOS profiles, power control. Dell reports that a low-privileged remote user can inject SQL, leading to script injection, with high confidentiality and availability impact and no integrity impact claimed. The value to an attacker is position: any privilege gain inside OME sits one step away from firmware and power control over every server it manages, and OME holds the credentials it uses to talk to those BMCs. Treat a compromised OME as a fleet-wide out-of-band compromise waiting to happen, not as a web app bug.

Who can reach it

An authenticated OME user with low privileges, over the network — normally the management VLAN, which is also where a compromised admin workstation would sit.

What to do

Dell states versions prior to 4.7.0 are affected; upgrade the OME appliance to 4.7.0 or later per DSA-2026-359. The upgrade restarts the appliance's services, so the console is unavailable during it, but nothing on the managed servers is interrupted — no compute downtime. Also worth doing regardless: confirm OME is not reachable from tenant or general corporate networks, and review the low-privilege accounts that exist on it.

References