Database/Firmware, BMC & network fabric
Dell OpenManage Enterprise: path traversal lets an admin write outside the intended directory
Impact
A high-privileged adjacent-network user can escape the intended directory and reach filesystem paths on the OpenManage Enterprise appliance, with integrity and availability rated high and confidentiality none - the shape of an arbitrary-write or overwrite primitive rather than a read. Writing outside the sandbox on the appliance that drives fleet firmware and power workflows is a route to persistence on the host that controls the managed GPU servers. Dell split this across two ids in DSA-2026-467 - CVE-2026-91903 and CVE-2026-91911 - with identical descriptions, scores and vectors; they are recorded here as one issue because an operator takes the same single action for both. The affected endpoints are not named.
Who can reach it
Adjacent-network access to the OME console with an administrator-level account. Authentication required.
What to do
Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and management-console restart, no managed-node downtime. One upgrade covers both ids. No interim workaround is published.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- Dell OpenManage Enterprise: unauthenticated XSS in the console tampers with informationCVE-2026-91907 · Dell OpenManage Enterprise (reflected cross-site scripting in the web console)Medium
- Intel Ethernet E810 Series and Ethernet 700 Series firmware: Out-of-bounds write in firmware across both the E810 lineCVE-2022-36382 · Intel Ethernet E810 Series and Ethernet 700 Series firmwareMedium
- Intel processors with SGX (shared resource isolation): Improper isolation of shared microarchitectural resources lets aCVE-2022-38090 · Intel processors with SGX (shared resource isolation)Medium
- Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit): The dynamic-counter netlink setter bounded itsCVE-2022-49199 · Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit)Medium
- AMD SEV-SNP firmware, guest teardown / UMC key seed handling: TENANT HANDOFF FAILURECVE-2023-31355 · AMD SEV-SNP firmware, guest teardown / UMC key seed handlingMedium
- AMI MegaRAC SPx (IPMI handler): Arbitrary file upload and download through the BMC's IPMI handlerCVE-2023-34342 · AMI MegaRAC SPx (IPMI handler)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.