Dell IDRAC8 Firmware vulnerabilities

10 CVEs affecting Dell IDRAC8 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34436, published 2023-01-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3705, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer…
CVE-2020-5344, published 2020-03-31. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this…
CVE-2018-1244, published 2018-07-02. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user…
CVE-2018-1243, published 2018-07-02. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via…
CVE-2016-5685, published 2016-11-29. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
CVE-2021-21510, published 2021-03-08. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’…
CVE-2018-15774, published 2018-12-13. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated…
CVE-2019-3764, published 2019-11-07. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated…
CVE-2022-34436, published 2023-01-18. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could…
CVE-2018-15776, published 2018-12-13. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this…