CVE-2019-3705: Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

4.17%

89.6th percentile

Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the webserver or execute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affected system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
dell	idrac6_firmware	< 2.92	2.92
dell	idrac7_firmware	< 2.61.60.60	2.61.60.60
dell	idrac8_firmware	< 2.61.60.60	2.61.60.60
dell	idrac9_firmware	< 3.20.21.20	3.20.21.20
dell_emc	idrac	>= 2.61.60.60 < 2.61.60.60	2.61.60.60
dell_emc	idrac	>= 2.92 < 2.92	2.92
dell_emc	idrac	>= 3.20.21.20 < 3.20.21.20	3.20.21.20
dell_emc	idrac	>= 3.21.24.22 < 3.21.24.22	3.21.24.22
dell_emc	idrac	>= 3.21.26.22 < 3.21.26.22	3.21.26.22
dell_emc	idrac	>= 3.23.23.23 < 3.23.23.23	3.23.23.23

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.