title: iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability
description: Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access.
problem types: Privilege escalation vulnerability.
affected:
{
product: iDRAC
vendor: Dell EMC
versions:
lessThan: 2.61.60.60, status: affected, version: iDRAC7, versionType: custom
lessThan: 2.61.60.60, status: affected, version: iDRAC8, versionType: custom
changes: [at: 3.21.24.22, status: unaffected], lessThan: 3.20.21.20, status: affected, version: iDRAC9, versionType: custom
lessThan: 3.23.23.23 , status: affected, version: iDRAC9 , versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.0
]