Intel Data Center Manager: Improper access control in Data Center Manager lets an unauthenticated attacker

Impact

Improper access control in Data Center Manager lets an unauthenticated attacker with adjacent network access escalate privilege. DCM is the fleet-wide power and thermal management plane - it holds credentials to platform management across every node it monitors, so compromising it is a lateral-movement jackpot rather than a single-host problem.

Who can reach it

Unauthenticated attacker on the same network segment as the DCM server. Whether that is a realistic position depends entirely on your management network segmentation.

What to do

Upgrade the Intel Data Center Manager software. This is a management-plane application, so the update is an application upgrade and service restart - no node drain, no firmware, no reboot of managed hosts. The real work is deciding what DCM is allowed to reach: it holds credentials for platform power and telemetry across the fleet, so its network exposure matters more than its version. Upgrade to 4.1 or later.

References