VulnerabilityModified

CVE-2018-1243

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability.

HIGH 7.5EPSS 1.82%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.82%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.82% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-358
Affected: dell/idrac6 firmware · dell/idrac7 firmware · dell/idrac8 firmware · dell/idrac9 firmware
Source: security_alert@emc.com

References

http://en.community.dell.com/techcenter/extras/m/white_papers/20487494Vendor Advisory
http://en.community.dell.com/techcenter/extras/m/white_papers/20487494Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.