CVE-2022-34396 Code injection in OpenManage Server Administrator (OMSA)
A local attacker can inject DLLs to execute arbitrary code with elevated privileges, leading to complete system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34396?
CVE-2022-34396 is a high-severity code injection vulnerability in Dell OpenManage Server Administrator (OMSA), published on 1 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges. Exploitation may lead to a complete system compromise.
Weakness: CWE-427
Which versions are affected by CVE-2022-34396?
It affects 1 product.
Products include Dell Openmanage Server Administrator.
How do I fix CVE-2022-34396?
No fix has been published for CVE-2022-34396 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-34396 being exploited?
There is no known exploitation of CVE-2022-34396 in the wild and no public exploit code.
Other vulnerabilities in Dell OpenManage Server Administrator (OMSA)
- CVE-2021-21513 Auth bypass in Dell Open Manage Server Administrator
- CVE-2026-81442 Privilege escalation in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81475 Auth bypass in OpenManage Server Administrator Managed Node (Patch) for Windows
- CVE-2026-81476 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Comm
- CVE-2026-81478 Hardcoded credentials in OpenManage Server Administrator Managed Node (Patch) for Windows
Sources
Also known as GHSA-pgvc-mqpm-6x6g.