vendor:
OpenManage Network Manager
by:
KoreLogic Security Research Team
6.5
CVSS
MEDIUM
Privilege Escalation
285, 284
CWE
Product Name: OpenManage Network Manager
Affected Version From: 6.2.0.51 SP3
Affected Version To: 6.5.3
Patch Exists: YES
Related CWE: CVE-2018-15767, CVE-2018-15768
CPE: a:dell:openmanage_network_manager
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Embedded Linux
2018
Dell OpenManage Network Manager Multiple Vulnerabilities
Dell OpenManage Network Manager exposes a MySQL listener that can be accessed with default credentials. This MySQL service is running as the root user, so an attacker can exploit this configuration to, e.g., deploy a backdoor and escalate privileges into the root account.
Mitigation:
Change all default passwords upon installation and upgrade to version 6.5.3.
