EUVD-2026-62413
GHSA-8cp6-c94h-9538
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description confirms only information exposure; I and A independently assessed as Low until write or availability impact is confirmed by the full vendor advisory.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
AnalysisAI
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged authenticated account on the Dell OpenManage Enterprise instance (PR:L per CVSS vector) and remote network access to the OME web management interface over HTTP/HTTPS (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 reflects a network-accessible attack vector, low complexity, and low-privilege requirement, making exploitation achievable by any authenticated user without specialized skills or tooling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privileged Dell OpenManage Enterprise account sends a crafted HTTP request to a vulnerable endpoint - such as a search, filter, or device-query function - embedding SQL metacharacters that alter the backend query logic. The injected SQL allows the attacker to enumerate the management database schema and extract sensitive records, including device credentials, SNMP community strings, user account data, and audit logs. … |
| Remediation | Upgrade Dell OpenManage Enterprise to version 4.7.0 or later, as confirmed by Dell advisory DSA-2026-359 at https://www.dell.com/support/kbdoc/en-us/000500910/dsa-2026-359-security-update-for-dell-openmanage-enterprise-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Dell OpenManage Enterprise instances in your environment and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openmanage Enterprise
View allDell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical seve
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to exe
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code In
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.
SQL injection in Dell OpenManage Enterprise versions prior to 4.7.0 enables low-privileged remote attackers to extract s
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated h
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), t
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attacker
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authen
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tool
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today