Dell Server Hardware Manager versions prior to 3.2.2 house an Improper Access Control flaw that allows a local user with lower privileges to gain higher-level access. The vulnerability enables an attacker who can physically or administratively log in locally to elevate their permissions within the hardware manager, potentially giving them control over server‑level configurations or sensitive data. The underlying weakness is categorized as CWE‑284, a failure to enforce access restrictions.

Vendors affected include Dell, specifically its Server Hardware Manager product. Impacted versions are any releases of Server Hardware Manager older than 3.2.2. Users running these legacy versions are susceptible to the privilege‑escalation flaw.

The vulnerability carries a CVSS score of 7.8, indicating a high impact if exploited. EPSS data is not available, so the likelihood of exploitation cannot be directly assessed, yet the lack of a KEV listing suggests no confirmed active exploitation at present. The exploit requires local, low‑privileged access; thus, an attacker must already be able to log into the server environment, whether by physical presence or compromised credentials. Given the potential for significant escalation, the risk remains high for systems that remain on legacy versions.