Multiple vulnerabilities in Dell EMC iDRAC7/iDRAC8
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-1207 CVE-2018-1211 CVE-2018-1000116 |
| CWE-ID | CWE-77 CWE-22 CWE-229 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
iDRAC7 Web applications / Remote management & hosting panels iDRAC8 Web applications / Remote management & hosting panels iDRAC9 Web applications / Remote management & hosting panels |
| Vendor | Dell |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Command injection
EUVDB-ID: #VU12132
Risk: High
CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2018-1207
CWE-ID:
CWE-77 - Command injection
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to CGI injection. A remote attacker can use CGI variables and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Update to version 2.52.52.52.
Vulnerable software versionsiDRAC7: 2.10.10.10 - 2.50.50.50
iDRAC8: 2.00.00.00 - 2.50.50.50
External linkshttp://en.community.dell.com/techcenter/extras/m/white_papers/20485410
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Path traversal
EUVDB-ID: #VU12133
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-1211
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists in the Web server's URI parser due to path traversal. A remote attacker can read configuration settings from the iDRAC by querying specific URI strings.
Update to version 2.52.52.52.
Vulnerable software versionsiDRAC7: 2.10.10.10 - 2.50.50.50
iDRAC8: 2.00.00.00 - 2.50.50.50
External linkshttp://en.community.dell.com/techcenter/extras/m/white_papers/20485410
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Remote code execution
EUVDB-ID: #VU11081
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-1000116
CWE-ID:
CWE-229 - Improper Handling of Values
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.
The weakness exists due to insufficient handling of UDP packets. A remote attacker can submit a specially crafted UDP packet and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Install update from vendor's website.
Vulnerable software versionsiDRAC9: 3.00.00.00 - 3.20.21.20
iDRAC8: 2.00.00.00 - 2.50.50.50
iDRAC7: 2.10.10.10 - 2.50.50.50
External linkshttp://en.community.dell.com/techcenter/extras/m/white_papers/20485410
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
