Dell System Update flaw exposes servers to remote code execution

Dell has alerted customers to a critical security flaw in its System Update tool for PowerEdge servers, which could allow remote attackers to run code as root by exploiting a path traversal vulnerability. Three additional vulnerabilities were also patched, including two that enable unauthorized remote code execution. Dell recommends updating to version 2.3.0.0 or later immediately, though there is no indication these flaws have been exploited yet.

• Critical vulnerability affects Dell System Update tool
• Attackers could gain root access on unpatched servers
• Multiple additional high-severity flaws also addressed
• No reports yet of active exploitation, but risk remains high