Description
The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected iDRAC system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dell EMC | iDRAC6 (Monolithic) | unspecified – < 2.91 | 2.91 |
| Dell EMC | iDRAC6 (Modular) | unspecified – ≤ 3.85 | — |