Intel Data Center Manager Console: Improper input validation in the DCM Console lets an authenticated user escalate

Impact

Improper input validation in the DCM Console lets an authenticated user escalate privilege over the network. Same management-plane exposure profile as the later DCM issues.

Who can reach it

Authenticated user with network access to the DCM console.

What to do

Upgrade the Intel Data Center Manager software. This is a management-plane application, so the update is an application upgrade and service restart - no node drain, no firmware, no reboot of managed hosts. The real work is deciding what DCM is allowed to reach: it holds credentials for platform power and telemetry across the fleet, so its network exposure matters more than its version. Upgrade to 3.6.2 or later.

References