CVE-2018-1214
First published: Mon Feb 12 2018(Updated: )
Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achieved by someone with knowledge of the default password. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user account is added as a member of the OmeAdministrators group for the OME. An unauthorized person with knowledge of the default password and access to the OME web console could potentially use this account to gain access to the affected installation of OME with OmeAdministrators privileges. This is fixed in version 1.2.1.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell SupportAssist | =1.1 | |
| Microsoft Windows Operating System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-1214?
CVE-2018-1214 is rated as a medium severity vulnerability due to the presence of a default user account with a known password.
How do I fix CVE-2018-1214?
To mitigate CVE-2018-1214, remove the default user account "OMEAdapterUser" and ensure the management console access is secured.
Which version of Dell EMC SupportAssist Enterprise is affected by CVE-2018-1214?
CVE-2018-1214 affects Dell EMC SupportAssist Enterprise version 1.1.
Does CVE-2018-1214 affect later versions of SupportAssist?
CVE-2018-1214 persists in version 1.2 as the unnecessary user account remains after upgrading from version 1.1.
What potential risks does CVE-2018-1214 pose?
CVE-2018-1214 poses risks of unauthorized access to the management console due to the existence of a default account with a known password.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/dell
- canonical/dell supportassist
- version/dell supportassist/1.1
- vendor/microsoft
- canonical/microsoft windows operating system