Vulnerability identifier: #VU66218
Vulnerability risk: Low
CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-287
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
iDRAC9
Web applications /
Remote management & hosting panels
Vendor: Dell
Description
The vulnerability allows a remote user to bypass authentication process.
The vulnerability exists due to an error in when processing authentication requests. A remote user with high privileges can exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
iDRAC9: 2.65.65.65 - 4.32.10.00
External links
http://www.dell.com/support/kbdoc/000185293
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.