CVE-2018-1243: Dell IDRAC6 Firmware

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.

Affected products

• Dell IDRAC6 Firmware: before 2.91 (fixed in 2.91)
• Dell IDRAC7 Firmware: before 2.60.60.60 (fixed in 2.60.60.60)
• Dell IDRAC8 Firmware: before 2.60.60.60 (fixed in 2.60.60.60)
• Dell IDRAC9 Firmware: before 3.21.21.21 (fixed in 3.21.21.21)

Published 2018-07-02. Last modified 2026-06-17.