An OS command injection vulnerability in Dell OpenManage Enterprise allows authenticated attackers to execute arbitrary code, creating a risk of full host system compromise.

This is an improper neutralization of special elements used in an OS command (CWE-78). By supplying crafted input to the application, an authenticated user can force the system to execute unauthorized commands at the operating system level.

The ability to execute arbitrary OS commands makes this a critical security concern, reflected by its CVSS score of 8.8. An attacker who successfully exploits this can gain full control over the management server, potentially leading to lateral movement across the network and complete infrastructure compromise.

Immediate Action: Upgrade to Dell OpenManage Enterprise version 4.7.0 or later to patch the command injection vulnerability.

Proactive Monitoring: Audit process execution logs on the OpenManage server for any suspicious or unexpected commands originating from the application service.

Compensating Controls: Restrict access to the OpenManage web interface to trusted management networks only to reduce the likelihood of unauthorized users reaching the vulnerable functionality.

Public Exploit Available: No

Immediate patching is required to address this command injection vulnerability. Ensure that your OpenManage Enterprise deployment is updated to version 4.7.0 and verify the integrity of the system after the update is applied.