Improper Authentication in iDRAC9 - CVE-2021-21544

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU66218

Improper Authentication in iDRAC9 - CVE-2021-21544

Published: August 9, 2022


Vulnerability identifier: #VU66218
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-21544
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote user with high privileges can exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.


Affected software

iDRAC9
EMC Data Domain

How to mitigate CVE-2021-21544

Install updates from vendor's website.

iDRAC9 - update to 4.40.00.00
EMC Data Domain - addressed in versions 6.2.1.60, 7.2.0.70, 7.6.0.7

External References

Related Security Bulletins