title: iDRAC6/iDRAC7/iDRAC8 - Weak CGI session ID vulnerability
description: Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.
problem types: Weak CGI session ID vulnerability.
affected:
{
product: iDRAC6
vendor: Dell EMC
versions:
lessThan: 2.91, status: affected, version: unspecified, versionType: custom
}
{
product: iDRAC7
vendor: Dell EMC
versions:
lessThan: 2.60.60.60, status: affected, version: unspecified, versionType: custom
}
{
product: iDRAC8
vendor: Dell EMC
versions:
lessThan: 2.60.60.60, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]