Database/Firmware, BMC & network fabric
Dell OpenManage Enterprise: unsanitized output injects script into a downstream component
Impact
OpenManage Enterprise fails to neutralize special elements in output consumed by a downstream component, letting a high-privileged adjacent-network user inject script there. Dell scores confidentiality, integrity and availability all high, so the injection lands somewhere with real authority rather than in a cosmetic field; the advisory does not identify the downstream component. Practically this is an admin-to-admin or admin-to-component escalation path inside the management console that runs the fleet's firmware and power workflows.
Who can reach it
Adjacent-network access to the OME console with an administrator-level account. Authentication required.
What to do
Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and console restart. Managed nodes need no action. No interim workaround is published.
References
Related entries
- OpenBMC bmcweb mTLS client-certificate UPN validation: Where mTLS is configured, bmcweb matches the certificate's UPNNCVD-2026-004-openbmc-bmcweb-mtls-client-certi · OpenBMC bmcweb mTLS client-certificate UPN validationMedium
- Cisco NX-OS CLI: CLI command injection giving root-level execution on the switch OS for an authenticated adminCVE-2017-12334 · Cisco NX-OS CLIMedium
- Intel Server Board / Server System / Compute Module platform firmware: Improper memory initialisation in platformCVE-2018-12204 · Intel Server Board / Server System / Compute Module platform firmwareMedium
- Intel Xeon D / Xeon Scalable system firmware, Server Board and Server System: A buffer overflow in system firmwareCVE-2019-0119 · Intel Xeon D / Xeon Scalable system firmware, Server Board and Server SystemMedium
- Intel Xeon system firmware: insufficient access control lets a privileged local user escalate or leak memoryCVE-2019-11136 · Intel Xeon Scalable / Xeon D system firmware (UEFI, 2019.2 IPU)Medium
- Intel SGX / dynamic voltage and frequency scaling interface: Undervolting the CPU through the privilegedCVE-2019-11157 · Intel SGX / dynamic voltage and frequency scaling interfaceMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.