CVE-2020-5377: Dell EMC OpenManage Server Administrator path traversal allows unauthenticated file access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.1 with no authentication or user interaction required, high EPSS, and public exploit references make this a high-urgency management-plane flaw.

What it is

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities in its Web API. An unauthenticated remote attacker can send crafted requests with directory traversal sequences to reach files on the management station. Because OMSA is a management-plane component, compromise exposes the host it runs on.

Impact

An attacker gains file system access on the compromised management station, with the CVSS vector indicating high confidentiality and integrity impact but no availability impact. This can expose sensitive configuration and credential material on a management host.

Attack surface

Reached over the network via the OMSA Web API; the CVSS vector shows no privileges required and no user interaction, so the flaw is exploitable pre-authentication. Any reachable OMSA web interface is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.48 (98.8th percentile) and public exploit references exist, including a Packet Storm file-read writeup. No ransomware use is documented.

What to do

• Upgrade OMSA to a version later than 9.4 per Dell advisory DSA-2020-172; patch first.
• Restrict network access to the OMSA web interface to trusted management networks only.
• Do not expose OMSA directly to the internet or untrusted segments.
• Where OMSA is not needed, disable or remove it to reduce management-plane exposure.
• Monitor and rotate any credentials or secrets stored on hosts running vulnerable OMSA.

Detection

• Inspect OMSA web server and proxy logs for requests containing traversal sequences such as ../ or encoded variants.
• Alert on unusual file-read patterns or unexpected paths requested against the OMSA Web API.
• Baseline normal OMSA API callers and flag new or anomalous source IPs hitting the interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.