Dell IDRAC6 Monolithic vulnerabilities

3 CVEs affecting Dell IDRAC6 Monolithic, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1212, published 2018-07-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-8272, published 2014-12-19. Medium severity, CVSS 5.0. EPSS: 19.2% chance of exploitation in the next 30 days. The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote…
CVE-2018-1212, published 2018-07-02. High severity, CVSS 8.8. EPSS: 4.3% chance of exploitation in the next 30 days. The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC…
CVE-2013-3589, published 2013-09-24. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before…