Dell IDRAC8 vulnerabilities

2 CVEs affecting Dell IDRAC8, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-3411, published 2024-04-30.

More from Dell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-25951, published 2024-03-09. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.
• CVE-2024-3411, published 2024-04-30. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random…