Brief Summary: CVE-2024-24909 Command Injection RCE in Dell OpenManage Integration with Windows Admin Center

Introduction

A command injection flaw in the Dell OpenManage Integration with Microsoft Windows Admin Center gateway plugin lets any authenticated user with low privileges execute arbitrary code on managed Dell PowerEdge servers. The flaw is tracked as CVE-2024-24909 and carries a CVSS score of 8.8. It turns a trusted management integration point into a potential launchpad for privilege escalation and remote code execution across an organization's server fleet.

Dell OpenManage Integration with Microsoft Windows Admin Center (OMIMSWAC) is a free extension that lets IT administrators manage Dell PowerEdge servers, Microsoft Failover Clusters, and Azure Stack HCI deployments directly from the Windows Admin Center (WAC) console. It supports lifecycle management operations on systems with iDRAC9 or iDRAC10 controllers and is widely deployed in enterprise environments that rely on Dell server infrastructure. Because Dell PowerEdge is a market leader in enterprise servers, OMIMSWAC is a significant management surface in many organizations.

Technical Information

Root Cause: CWE-77 Command Injection

CVE-2024-24909 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). According to MITRE's definition, CWE-77 occurs when software builds a command from externally influenced input without neutralizing special elements that could modify the command sent to a downstream component. CWE-77 is the parent category of both CWE-78 (OS Command Injection) and CWE-88 (Argument Injection), and is itself a child of CWE-74 (Injection).

The vulnerability sits in the gateway plugin component of OMIMSWAC, and that location matters because of how Windows Admin Center extensions are structured. According to Microsoft's documentation, a WAC extension has two parts: a front-end user interface and a gateway plugin that executes the actual tasks on managed nodes. WAC ships with two built-in gateway plugins, one for executing PowerShell scripts and another for WMI commands.

In the WAC security model, the gateway is the authentication and identity management layer, so extensions do not handle user credentials directly. Gateway plugins are the security boundary. They proxy requests from the extension to the managed node, which makes the gateway plugin the component trusted to execute operations on target servers. A command injection flaw in that boundary component effectively undermines the entire security model, because the plugin is the entity authorized to run commands on managed infrastructure.

CVSS Vector Breakdown

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H breaks down as follows:

Network access, low attack complexity, and high impact on all three security properties make this an especially dangerous vulnerability for any exposed deployment.

Attack Flow

Based on the advisory and the architecture described above, exploitation follows this pattern:

1. An attacker obtains authenticated access to the Windows Admin Center gateway. The PR:L requirement means even minimal privileges are enough. This could be a standard IT operations account, a compromised service account, or any user granted WAC access.

2. The attacker crafts input containing command injection delimiters (such as semicolons or other special characters) and sends it to the OMIMSWAC gateway plugin. CWE-77 vulnerabilities are typically exploited by injecting delimiters that make the system execute new, unrelated commands beyond the one originally intended.

3. Because the gateway plugin is the trusted component that executes commands on managed Dell PowerEdge servers, the injected commands run with the privileges of the gateway plugin process. Dell's advisory confirms that "a remote authenticated user could potentially exploit this vulnerability to escalate privileges."

4. The attacker escalates privileges and can run arbitrary code remotely on managed nodes, with the full confidentiality, integrity, and availability impact reflected in the CVSS score.

The exact input fields, injection payload structure, and code paths have not been publicly disclosed. That fits Dell's responsible disclosure approach of withholding exploitation details to protect unpatched deployments.

Architectural Significance

The gateway plugin proxies requests between the WAC extension and the managed servers. A command injection at that point is architecturally equivalent to compromising the management plane itself. Any Dell PowerEdge server managed through an affected OMIMSWAC instance is potentially within the blast radius of a successful exploit.

Patch Information

Dell addressed CVE-2024-24909 in security advisory DSA-2024-084, published on February 14, 2024. The only remediation is upgrading to OMIMSWAC version 3.2.0 (build A00). All versions up to and including version 3.1 are vulnerable.

The patched package is available from Dell's support portal as driver package ID C3V54. It ships as Dell_OpenManage_Integration_MS_WAC_3.2.0_A00.zip, a roughly 6.6 MB archive containing the dell-emc.openmanage-integration.3.2.0.nupkg NuGet package. The v3.2.0 package itself was released on December 13, 2023, so the fixed binary was available before Dell formally published the advisory in February 2024.

You can install it through Microsoft's public Windows Admin Center Azure DevOps feed (for automatic updates), or manually by pointing the WAC Extensions settings at a local path or network share that holds the extracted package.

Dell's advisory states that no workarounds or mitigations exist for this vulnerability. Upgrading to version 3.2.0 is the only path to remediation.

To verify the integrity of the patched download, check it against these hashes:

OMIMSWAC is a closed-source proprietary product, so there is no public source code diff or commit showing the code-level changes that fix the command injection flaw.

Affected Systems and Versions

The following versions of Dell OpenManage Integration with Microsoft Windows Admin Center are affected:

The affected product manages Dell PowerEdge servers as hosts, Microsoft Failover Clusters, and Azure Stack Hyper Converged Infrastructure, including AX nodes and Storage Spaces Direct Ready Nodes. Any deployment using OMIMSWAC v3.1 or earlier to manage these systems is vulnerable.

The v3.2.0 release also added support for the modernized gateway framework with .NET Core and Angular 15 as part of the WAC 2410 update, along with Windows Server 2025 OS support for 15G and 16G platforms. The move to .NET Core may be connected to the fix, if the command injection flaw lived in the older framework components of v3.1 and earlier.

Vendor Security History

Dell's security record is useful context for organizations deciding how urgently to patch CVE-2024-24909.

Cybersecurity Asia described the 2024 incidents collectively as a "Triple Breach" and a "critical wake up call" for the industry. The May 2024 breach of 49 million customer records shows that attackers have successfully targeted Dell infrastructure and data stores at scale.

Within the OpenManage product line, Dell has issued multiple security advisories: DSA-2024-084 (this vulnerability), DSA-2024-490 for Dell OpenManage Enterprise, and DSA-2026-045 for Dell OpenManage Network Integration (OMNI). This pattern indicates that the line's integration surfaces, particularly gateway plugins and API interfaces, are a recurring vulnerability class that organizations should monitor proactively.

Threat Intelligence Context

As of the review date, CVE-2024-24909 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no evidence of active exploitation has been found. No threat actor groups have been publicly associated with exploiting this CVE, and no legitimate proof-of-concept exploit code has been identified on security research platforms or code repositories.

VulnCheck's 2024 exploitation trends analysis found that about 1% of all published CVEs were reported as exploited in the wild. CVE-2024-24909 is not currently in that set, but its characteristics (CVSS 8.8, RCE capability, network accessibility, low attack complexity) make it a strong candidate for future exploitation.

Defenders should also know that Uptycs has reported a trend of fake PoC repositories on GitHub that claim to contain exploit code for CVEs but actually contain malicious code. Treat any purported PoC for CVE-2024-24909 on GitHub or similar platforms with extreme caution, and verify it against trusted security research sources before running it.

References

• NVD: CVE-2024-24909
• DSA-2024-084: Security Update for Dell OpenManage Integration with Microsoft Windows Admin Center
• Dell OMIMSWAC v3.2.0 Download (Driver ID C3V54)
• OMIMSWAC Support for Dell OpenManage Integration with Microsoft Windows Admin Center
• CWE-77: Improper Neutralization of Special Elements used in a Command (MITRE)
• Understanding Windows Admin Center Extensions (Microsoft Learn)
• CISA Known Exploited Vulnerabilities Catalog
• 2024 Trends in Vulnerability Exploitation (VulnCheck)
• Dell Security Advisories, Notices and Resources
• Dell Computer Data Breach Potentially Impacts 49 Million Customers (HALOCK)
• Dell's Triple Breach: A Critical Wake Up Call (Cybersecurity Asia)
• Beware of Fake PoC Repositories and Malicious Code on GitHub (Uptycs)