What’s Vulnerable › Vulnerabilities
CVE-2021-36299
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 29.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-11-23 · updated 2026-06-17
- Weakness: CWE-89
Description
Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.
Affected products
- Dell Emc Idrac9 Firmware: from 4.40.00.00 before 4.40.29.00; 5.00.00.00 — fixed in 4.40.29.00
How to fix
Upgrade to a fixed version: Dell Emc Idrac9 Firmware 4.40.29.00. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2021-36299 or the next vulnerability affects your stack