CVE-2018-15776: iDRAC7, iDRAC8 - Improper Error Handling

Severity: medium (CVSS 6.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-13 · updated 2026-06-17

Description

Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.

Affected products

Dell Idrac7 Firmware: before 2.61.60.60 — fixed in 2.61.60.60
Dell Idrac8 Firmware: before 2.61.60.60 — fixed in 2.61.60.60

How to fix

Upgrade to a fixed version: Dell Idrac7 Firmware 2.61.60.60; Dell Idrac8 Firmware 2.61.60.60. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106233
https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en
http://www.securityfocus.com/bid/106233
https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en

Get alerted when CVE-2018-15776 or the next vulnerability affects your stack