CVE-2018-1249: iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-02 · updated 2026-06-17

Description

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.

Affected products

Dell EMC iDRAC: before 3.21.21.21 — fixed in 3.21.21.21

How to fix

Upgrade to a fixed version: Dell EMC iDRAC 3.21.21.21. Check the vendor advisory for mitigations.

References

http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
http://en.community.dell.com/techcenter/extras/m/white_papers/20487494

Get alerted when CVE-2018-1249 or the next vulnerability affects your stack