Dell EMC SupportAssist Enterprise 1.1 hard-coded credentials

Summaryinfo

A vulnerability, which was classified as critical, has been found in Dell EMC SupportAssist Enterprise 1.1. This impacts an unknown function. The manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2018-1214. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Dell EMC SupportAssist Enterprise 1.1. This issue affects an unknown functionality. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achieved by someone with knowledge of the default password. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user account is added as a member of the OmeAdministrators group for the OME. An unauthorized person with knowledge of the default password and access to the OME web console could potentially use this account to gain access to the affected installation of OME with OmeAdministrators privileges. This is fixed in version 1.2.1.

The bug was discovered 02/13/2018. The weakness was disclosed 02/12/2018 (Website). The advisory is shared at dell.com. The identification of this vulnerability is CVE-2018-1214 since 12/06/2017. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/17/2020). MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Dell EMC

Name

• SupportAssist Enterprise

Version

• 1.1

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion