Read the docs
TI-2018-01125 Aliases CVE-2018-1214GHSA-v4fx-vr9m-2x7v

Hard-coded credentials in Dell SupportAssist Enterprise version 1.1

Priority LOW 32CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achieved by someone with knowledge of the default password. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user account is added as a member of the OmeAdministrators group for the OME. An unauthorized person with knowledge of the default password and access to the OME web console could potentially use this account to gain access to the affected installation of OME with OmeAdministrators privileges. This is fixed in version 1.2.1.

Why it matters now

EPSS 0.00759 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Dell SupportAssist Enterprise version 1.1Dell SupportAssist Enterprise version 1.1—No fix listedCNA
  • Dell SupportAssist Enterprise version 1.1 Vendor— Affected Dell SupportAssist Enterprise version 1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_supportassist_enterprise:1.1:*:*:*:*:*:*:*1.1VulnerableDell
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:dell:emc_supportassist_enterprise:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Dell
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1214
  2. 2026-10-03 Alias added: GHSA-v4fx-vr9m-2x7v

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences