Dell IDRAC9 Firmware vulnerabilities

21 CVEs affecting Dell IDRAC9 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-22397, published 2025-11-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3705, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer…
CVE-2020-5344, published 2020-03-31. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this…
CVE-2018-1244, published 2018-07-02. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user…
CVE-2019-3707, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to…
CVE-2019-3706, published 2019-04-26. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to…
CVE-2018-1243, published 2018-07-02. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via…
CVE-2020-5366, published 2020-07-09. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by…
CVE-2021-21538, published 2021-07-29. Critical severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this…
CVE-2021-21540, published 2021-04-30. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration…
CVE-2020-26198, published 2020-12-16. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this…

Latest

CVE-2025-22397, published 2025-11-06. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G…
CVE-2025-26482, published 2025-09-25. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability,…
CVE-2022-34435, published 2023-01-18. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could…
CVE-2021-21544, published 2021-04-30. Low severity, CVSS 2.7. EPSS: 0.9% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability…
CVE-2021-21543, published 2021-04-30. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these…
CVE-2021-21542, published 2021-04-30. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these…
CVE-2021-21541, published 2021-04-30. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a…
CVE-2021-21539, published 2021-04-30. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to…