CVE-2024-45766: Dell OpenManage Enterprise RCE Vulnerability

CVE-2024-45766 Overview

CVE-2024-45766 is a code injection vulnerability [CWE-94] affecting Dell OpenManage Enterprise version 4.1 and prior. The flaw arises from improper control of code generation within the management console. A remote attacker holding low-level privileges can exploit the weakness to execute arbitrary code on the affected system. Dell disclosed the issue in advisory DSA-2024-426 and released a security update to address it.

Critical Impact
Successful exploitation grants an authenticated remote attacker code execution on the OpenManage Enterprise server, compromising the confidentiality, integrity, and availability of downstream managed infrastructure.

Affected Products

Dell OpenManage Enterprise 4.1
Dell OpenManage Enterprise versions prior to 4.1
Systems managed through the affected OpenManage Enterprise console

Discovery Timeline

2024-10-17 - CVE-2024-45766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45766

Vulnerability Analysis

Dell OpenManage Enterprise is a systems management console used to monitor and administer Dell PowerEdge servers and connected infrastructure. The product fails to properly control the generation of code from user-supplied input, mapping to [CWE-94] Improper Control of Generation of Code. A low-privileged authenticated user with network access to the management interface can supply crafted input that the application interprets and executes as code.

The attack requires network reachability to the OpenManage Enterprise instance and valid low-privilege credentials. No user interaction is required, and the scope remains unchanged, meaning code executes within the security context of the vulnerable service. Given the elevated role OpenManage Enterprise plays in datacenter operations, code execution on the console can cascade into administrative control over managed servers.

Root Cause

The vulnerability stems from insufficient validation and sanitization of input that flows into a code generation or evaluation path within OpenManage Enterprise. The application constructs executable code or commands from attacker-controllable data without enforcing safe parsing boundaries. Dell has not published low-level implementation details in the public advisory.

Attack Vector

An authenticated attacker with low privileges sends crafted requests to the OpenManage Enterprise web interface or API over the network. The malicious payload is interpreted by a vulnerable code generation routine, resulting in arbitrary code execution on the host running the console. Because OpenManage Enterprise typically holds credentials and access to managed hardware, the attacker can pivot to broader infrastructure control.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical exploitation specifics are documented in the Dell Security Update DSA-2024-426.

Detection Methods for CVE-2024-45766

Indicators of Compromise

Unexpected child processes spawned by the OpenManage Enterprise service account or web application process.
Anomalous outbound network connections originating from the OpenManage Enterprise host.
New or modified files in OpenManage Enterprise web application directories that do not correspond to a scheduled update.
Authentication events from low-privileged accounts followed by administrative actions on managed devices.

Detection Strategies

Monitor OpenManage Enterprise application and audit logs for unusual API calls, especially those containing script or code-like payloads from low-privileged users.
Baseline expected process trees for the OpenManage Enterprise service and alert on deviations such as shell interpreters or scripting engines being spawned.
Correlate authentication logs with subsequent privileged operations to detect privilege abuse following a login by a low-privileged account.

Monitoring Recommendations

Enable verbose audit logging on the OpenManage Enterprise appliance and forward logs to a centralized SIEM for retention and correlation.
Alert on process creation events where the OpenManage Enterprise service account launches interpreters such as cmd.exe, powershell.exe, bash, or python.
Track configuration changes and job submissions in OpenManage Enterprise to detect misuse of legitimate features that could mask exploitation.

How to Mitigate CVE-2024-45766

Immediate Actions Required

Upgrade Dell OpenManage Enterprise to the fixed release identified in DSA-2024-426.
Restrict network access to the OpenManage Enterprise management interface to trusted administrative networks only.
Audit user accounts within OpenManage Enterprise and remove or downgrade any accounts that do not require access.
Rotate credentials used by OpenManage Enterprise to access managed devices after patching.

Patch Information

Dell released a security update addressing CVE-2024-45766 through advisory DSA-2024-426. Administrators should review the Dell Security Update DSA-2024-426 for the fixed version and upgrade instructions.

Workarounds

Place the OpenManage Enterprise console behind a management VLAN or jump host to limit exposure until patching completes.
Enforce multi-factor authentication and strong password policies on all OpenManage Enterprise accounts to reduce the risk of credential-based exploitation.
Disable or restrict any local accounts not actively required for daily operations.

bash

# Example: restrict access to OpenManage Enterprise management port via host firewall
# Allow only the administrative subnet 10.10.50.0/24 to reach TCP/443
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP