high7.5
CVE-2018-1243
Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vu…
Impact
Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dell | Idrac6 Firmware | before 2.91 |
| Dell | Idrac7 Firmware | before 2.60.60.60 |
| Dell | Idrac8 Firmware | before 2.60.60.60 |
| Dell | Idrac9 Firmware | before 3.21.21.21 |