CVE-2018-11053: iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-26 · updated 2026-06-17
Weakness: CWE-732

Description

Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.

Affected products

Dell iDRAC Service Module (iSM): 3.0.1, 3.0.2, 3.1.0, 3.2.0 (and their updates)

References

http://www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en
http://www.securityfocus.com/bid/104567
http://www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en
http://www.securityfocus.com/bid/104567

Get alerted when CVE-2018-11053 or the next vulnerability affects your stack