CVE-2018-1211

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-23 · updated 2026-06-17
Weakness: CWE-22

Description

Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings.

Affected products

Dell Emc Idrac7: before 2.52.52.52 — fixed in 2.52.52.52
Dell Emc Idrac8: before 2.52.52.52 — fixed in 2.52.52.52

How to fix

Upgrade to a fixed version: Dell Emc Idrac7 2.52.52.52; Dell Emc Idrac8 2.52.52.52. Check the vendor advisory for mitigations.

References

http://en.community.dell.com/techcenter/extras/m/white_papers/20485410
http://en.community.dell.com/techcenter/extras/m/white_papers/20485410

Get alerted when CVE-2018-1211 or the next vulnerability affects your stack