CVE-2018-1212

Authenticated remote code execution in iDRAC 6

High · published July 2, 2018

CVSS v3.0
8.8
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected iDRAC system.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04335 · 91.2th percentile
Published
2018-07-02T17:00Z
EPSS history
Timeline
  • 02 JUL 17:00Z
    Authenticated remote code execution in iDRAC 6
    cvelistv5