Products
iDRAC9
- before 7.00.00.172 for 14th Generation
- before 7.10.50.00 for 15th and 16th Generations
Source
security_alert@emc.com
Tags
CVE-2024-25943 details
Published : June 29, 2024, 1:15 p.m.
Last Modified : June 29, 2024, 1:15 p.m.
Last Modified : June 29, 2024, 1:15 p.m.
Description
iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.6 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
LOW
Base Score
7.6
Exploitability Score
2.8
Impact Score
4.7
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
References
| URL | Source |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability | security_alert@emc.com |
This website uses the NVD API, but is not approved or certified by it.