Dell IDRAC6 Firmware vulnerabilities

4 CVEs affecting Dell IDRAC6 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-3705, published 2019-04-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3705, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer…
CVE-2013-4785, published 2013-07-08. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request to an unspecified…
CVE-2018-1243, published 2018-07-02. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via…
CVE-2013-3589, published 2013-09-24. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before…