Brief Summary: CVE-2024-24909 Command Injection RCE in Dell OpenManage Integration with Windows Admin Center

Introduction

A command injection flaw in the Dell OpenManage Integration with Microsoft Windows Admin Center gateway plugin gives any authenticated user with low privileges the ability to execute arbitrary code on managed Dell PowerEdge servers. Tracked as CVE-2024-24909 with a CVSS score of 8.8, this vulnerability turns a trusted management integration point into a potential launchpad for privilege escalation and remote code execution across an organization's server fleet.

Dell OpenManage Integration with Microsoft Windows Admin Center (OMIMSWAC) is a free extension that enables IT administrators to manage Dell PowerEdge servers, Microsoft Failover Clusters, and Azure Stack HCI deployments directly from the Windows Admin Center (WAC) console. It supports lifecycle management operations on systems with iDRAC9 or iDRAC10 controllers and is widely deployed in enterprise environments that rely on Dell server infrastructure. Given Dell PowerEdge's position as a market leader in enterprise servers, OMIMSWAC represents a significant management surface across many organizations.

Technical Information

Root Cause: CWE-77 Command Injection

CVE-2024-24909 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). According to MITRE's definition, CWE-77 occurs when software constructs a command using externally influenced input without properly neutralizing special elements that could modify the intended command sent to a downstream component. This is a parent category to both CWE-78 (OS Command Injection) and CWE-88 (Argument Injection), and is itself a child of CWE-74 (Injection).

The vulnerability resides specifically in the gateway plugin component of OMIMSWAC. To understand why this is architecturally significant, we need to look at how Windows Admin Center extensions are structured. According to Microsoft's documentation, WAC extensions consist of two parts: a front end user interface and a gateway plugin that executes actual tasks on managed nodes. WAC ships with two built in gateway plugins: one for executing PowerShell scripts and another for WMI commands.

The WAC security model positions the gateway as the authentication and identity management layer, ensuring extensions do not directly handle user credentials. Gateway plugins serve as the security boundary by proxying requests from the extension to the managed node. This design means the gateway plugin is the component trusted to execute operations on target servers. A command injection vulnerability in this boundary component effectively undermines the entire security model, because the plugin is the entity authorized to run commands on managed infrastructure.

CVSS Vector Breakdown

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H provides a detailed picture of the attack surface:

The combination of network accessibility, low attack complexity, and high impact across all three security properties makes this a particularly dangerous vulnerability for any exposed deployment.

Attack Flow

Based on the advisory details and architectural context, the exploitation scenario follows this pattern:

1. Initial Access: An attacker obtains authenticated access to the Windows Admin Center gateway. The PR:L requirement means even minimal privileges are sufficient; this could be a standard IT operations account, a compromised service account, or any user granted WAC access.

2. Input Injection: The attacker crafts input containing command injection delimiters (such as semicolons or other special characters) targeting the OMIMSWAC gateway plugin. CWE-77 vulnerabilities are typically exploited by injecting delimiters that cause the system to execute entirely new and unrelated commands beyond what was originally intended.

3. Command Execution: Because the gateway plugin is the trusted component responsible for executing commands on managed Dell PowerEdge servers, the injected commands execute with the privileges of the gateway plugin process. Dell's advisory confirms that "a remote authenticated user could potentially exploit this vulnerability to escalate privileges."

4. Privilege Escalation and Arbitrary Code Execution: The attacker gains the ability to run arbitrary code remotely on managed nodes, achieving full confidentiality, integrity, and availability impact as reflected in the CVSS score.

The exact input fields, injection payload structure, and code paths have not been publicly disclosed, which is consistent with Dell's responsible disclosure approach of withholding exploitation details to protect unpatched deployments.

Architectural Significance

The gateway plugin's position in the WAC architecture makes this vulnerability particularly impactful. The plugin acts as a proxy between the WAC extension and managed servers, meaning a command injection here is architecturally equivalent to compromising the management plane itself. Any Dell PowerEdge server managed through the affected OMIMSWAC instance is potentially within the blast radius of a successful exploit.

Patch Information

Dell addressed CVE-2024-24909 through security advisory DSA-2024-084, published on February 14, 2024. The sole remediation is upgrading to OMIMSWAC version 3.2.0 (build A00). All versions prior to and including version 3.1 are vulnerable.

The patched package is available as driver package ID C3V54 from Dell's support portal and is distributed as Dell_OpenManage_Integration_MS_WAC_3.2.0_A00.zip, a roughly 6.6 MB archive containing the dell-emc.openmanage-integration.3.2.0.nupkg NuGet package. Notably, the v3.2.0 package itself was released on December 13, 2023, meaning the fixed binary was available before the advisory was formally published in February 2024.

Installation can be performed either through Microsoft's public Windows Admin Center Azure DevOps feed (for automatic updates) or manually by pointing the WAC Extensions settings to a local path or network share containing the extracted package.

Dell's advisory is explicit: no workarounds or mitigations exist for this vulnerability. Upgrading to version 3.2.0 is the only path to remediation.

For verification, the integrity of the patched download can be confirmed using the following checksums:

Because OMIMSWAC is a closed source proprietary product, no public source code diff or commit is available to inspect the precise code level changes that remediate the command injection flaw.

Affected Systems and Versions

The following versions of Dell OpenManage Integration with Microsoft Windows Admin Center are affected:

The affected product manages Dell PowerEdge servers as hosts, Microsoft Failover Clusters, and Azure Stack Hyper Converged Infrastructure, including AX nodes and Storage Spaces Direct Ready Nodes. Any deployment using OMIMSWAC v3.1 or earlier to manage these systems is vulnerable.

The v3.2.0 release also introduced support for the modernized gateway framework with .NET Core and Angular 15 as part of the WAC 2410 update, along with Windows Server 2025 OS support for 15G and 16G platforms. The transition to .NET Core may be relevant to the vulnerability remediation, as the older framework components in v3.1 and earlier could have harbored the command injection flaw.

Vendor Security History

Dell's security track record provides important context for organizations assessing the urgency of patching CVE-2024-24909.

Cybersecurity Asia described the 2024 incidents collectively as a "Triple Breach" and a "critical wake up call" for the industry. The 49 million customer record breach in May 2024 demonstrates that Dell infrastructure and data stores have been successfully targeted at scale.

Within the OpenManage product line specifically, multiple security advisories have been issued: DSA-2024-084 (this vulnerability), DSA-2024-490 for Dell OpenManage Enterprise, and DSA-2026-045 for Dell OpenManage Network Integration (OMNI). This pattern indicates that the OpenManage product line's integration surfaces, particularly gateway plugins and API interfaces, represent a recurring vulnerability class that organizations should monitor proactively.

Threat Intelligence Context

As of the review date, CVE-2024-24909 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no evidence of active exploitation has been discovered. No threat actor groups have been publicly associated with exploiting this CVE, and no legitimate proof of concept exploit code has been identified on security research platforms or code repositories.

However, VulnCheck's 2024 exploitation trends analysis found that approximately 1% of all published CVEs were reported as exploited in the wild. While CVE-2024-24909 currently falls outside that exploited set, its characteristics (CVSS 8.8, RCE capability, network accessible, low attack complexity) make it a strong candidate for future exploitation.

One additional note for defenders: Uptycs has reported a trend of fake PoC repositories appearing on GitHub that purport to contain exploit code for CVEs but actually contain malicious code. Any purported PoC for CVE-2024-24909 found on GitHub or similar platforms should be treated with extreme caution and verified against trusted security research sources before execution.

References

• NVD: CVE-2024-24909
• DSA-2024-084: Security Update for Dell OpenManage Integration with Microsoft Windows Admin Center
• Dell OMIMSWAC v3.2.0 Download (Driver ID C3V54)
• OMIMSWAC Support for Dell OpenManage Integration with Microsoft Windows Admin Center
• CWE-77: Improper Neutralization of Special Elements used in a Command (MITRE)
• Understanding Windows Admin Center Extensions (Microsoft Learn)
• CISA Known Exploited Vulnerabilities Catalog
• 2024 Trends in Vulnerability Exploitation (VulnCheck)
• Dell Security Advisories, Notices and Resources
• Dell Computer Data Breach Potentially Impacts 49 Million Customers (HALOCK)
• Dell's Triple Breach: A Critical Wake Up Call (Cybersecurity Asia)
• Beware of Fake PoC Repositories and Malicious Code on GitHub (Uptycs)