Dell IDRAC7 Firmware vulnerabilities

9 CVEs affecting Dell IDRAC7 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-5344, published 2020-03-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3705, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer…
CVE-2020-5344, published 2020-03-31. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this…
CVE-2018-1244, published 2018-07-02. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user…
CVE-2018-1243, published 2018-07-02. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via…
CVE-2016-5685, published 2016-11-29. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
CVE-2013-3589, published 2013-09-24. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before…
CVE-2018-15774, published 2018-12-13. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated…
CVE-2019-3764, published 2019-11-07. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated…
CVE-2018-15776, published 2018-12-13. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this…