Dell · the BMC layer
PWX for iDRAC
Dell iDRAC: the known vulnerabilities of its firmware, how to give a scanner read-only access, and the settings to check. Free, no account.
The BMC is one layer of PWX, which covers the stack from the tenant and its VMs to the host, BMC, CPU, GPU and TPU. See every layer
55 CVEs9 critical20 high0 exploited (KEV)
1. Known vulnerabilities
| CVE | Severity | Published | Summary |
|---|---|---|---|
| CVE-2026-23855 | high 7.2 | 2026-09-09 | Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('... |
| CVE-2026-79940 | medium 5.9 | 2026-08-26 | Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this... |
| CVE-2026-70412 | low 3.5 | 2026-08-17 | Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potential... |
| CVE-2026-28262 | medium 6 | 2026-06-09 | Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulner... |
| CVE-2026-42997 | high 7.7 | 2026-05-05 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone t... |
| CVE-2026-35155 | high 7.1 | 2026-04-29 | Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain... |
| CVE-2025-22397 | medium 4.9 | 2025-11-06 | Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.2... |
| CVE-2025-26482 | medium 4.9 | 2025-09-25 | Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Inform... |
| CVE-2025-27689 | high 7.8 | 2025-06-12 | Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of pr... |
| CVE-2024-25943 | critical 9.8 | 2024-06-29 | iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerabilit... |
| CVE-2022-34436 | medium 4.9 | 2023-01-18 | Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerabili... |
| CVE-2022-34435 | medium 4.9 | 2023-01-18 | Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerabili... |
| CVE-2022-24422 | critical 9.8 | 2022-05-26 | Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the V... |
| CVE-2022-24423 | high 7.5 | 2022-04-21 | Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulti... |
| CVE-2021-36348 | high 8.1 | 2022-01-25 | iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or den... |
| CVE-2021-36347 | high 7.2 | 2022-01-25 | iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vul... |
| CVE-2021-36346 | medium 5.3 | 2022-01-25 | Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver. |
| CVE-2021-36301 | high 7.2 | 2021-11-23 | Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control proces... |
| CVE-2021-36300 | high 8.2 | 2021-11-23 | iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to... |
| CVE-2021-36299 | high 8.1 | 2021-11-23 | Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerab... |
| CVE-2021-21581 | medium 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tr... |
| CVE-2021-21580 | medium 4.3 | 2021-08-03 | Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the app... |
| CVE-2021-21579 | medium 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim user... |
| CVE-2021-21578 | medium 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim user... |
| CVE-2021-21577 | medium 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s bro... |
Source: NVD, NVD CVE API 2.0: cpe:2.3:o:dell:idrac10_firmware, cpe:2.3:o:dell:idrac9_firmware, cpe:2.3:o:dell:emc_idrac9_firmware, cpe:2.3:a:dell:idrac9, cpe:2.3:o:dell:idrac8_firmware, cpe:2.3:o:dell:idrac7_firmware, keyword "iDRAC", refreshed 2026-10-29 09:17 UTC. EXPLOITED = listed in the CISA KEV catalog.
2. Give a scanner read-only access
Role Read Only (formerly Guest User) has the Login privilege only.
- Web interface: iDRAC Settings > Users > Local Users. Pick an empty user slot (user 1 is reserved), enable it, set name and password, role Read Only, Save.
- racadm:
racadm set iDRAC.Users.<n>.UserName pwx-ro racadm set iDRAC.Users.<n>.Password <long random> racadm set iDRAC.Users.<n>.Privilege 0x1 # Log in to iDRAC only racadm set iDRAC.Users.<n>.Enable 1 - Redfish, iDRAC9: accounts live in fixed slots 2 to 16, so you PATCH a free slot instead of POSTing a new account:
curl -sk -u root -H 'Content-Type: application/json' -X PATCH \ https://<idrac>/redfish/v1/Managers/iDRAC.Embedded.1/Accounts/<n> \ -d '{"UserName":"pwx-ro","Password":"<long random>","RoleId":"ReadOnly","Enabled":true}' - Redfish, iDRAC10:
POST /redfish/v1/AccountService/Accountswith the same body works.
Sources: Dell iDRAC9 roles and privileges · configuring local users · racadm privilege bitmask · Dell iDRAC Redfish scripting (accounts)
3. Settings that open the power path
Dell's security configuration guide recommends, among others (iDRAC attributes, readable at /redfish/v1/Managers/iDRAC.Embedded.1/Oem/Dell/DellAttributes/iDRAC.Embedded.1):
IPMILan.1.EnableandIPMISOL.1.Enable: Disabled.Telnet.1.Enable: Disabled (removed from firmware 4.40.00.00 on).SNMP.1.AgentEnable: Disabled; if SNMP is needed, SNMPv3 traps.WebServer.1.TLSProtocol: TLS 1.3 only, HTTP redirected to HTTPS.VirtualMedia.1.Enable,OS-BMC.1.AdminState(host to iDRAC pass-through),VNCServer.1.Enable: Disabled where not used.- SSH off when not needed; IP blocking on; System Lockdown during normal operation.
Sources: Dell: security recommendations for interfaces, protocols and services · Dell IdracHardeningREDFISH.py · iDRAC10 web server. Whether a Read Only account may read DellAttributes depends on the firmware: test it on one server first.
Standard Redfish checks
| Redfish property | Want | Why |
|---|---|---|
| NetworkProtocol IPMI.ProtocolEnabled | false | IPMI 2.0 RAKP leaks password hashes to anyone who can reach the port (CVE-2013-4786). |
| NetworkProtocol Telnet.ProtocolEnabled | false | Credentials and commands travel in clear text. |
| NetworkProtocol HTTP.ProtocolEnabled | false | The web and Redfish interface is reachable without TLS. |
| NetworkProtocol SNMP.EnableSNMPv1 / EnableSNMPv2c | false (SNMPv3 only) | No authentication beyond a clear-text community string. |
| AccountService AccountLockoutThreshold | greater than 0 | With 0, BMC passwords can be guessed without limit. |
| HostInterface AuthenticationModes | no AuthNone | AuthNone lets any process on the host drive the BMC, and through it the power path, without credentials. |
| HostInterface CredentialBootstrapping.Enabled | false | The host OS can mint its own BMC account at any time. |
| Accounts with RoleId Administrator | one break-glass account | Each administrator can rewrite the power path. |
The Redfish Inspector checks each of these for you.
Vendor security advisories: www.dell.com/support/security/en-us. New CVEs also appear in PWX news.
4. Check it
- One BMC, in your browser: collect its Redfish answers and paste them into the Redfish Inspector. On iDRAC the manager is usually
/redfish/v1/Managers/iDRAC.Embedded.1. - All of them, from one machine that reaches the BMC network:
Every request is a GET and is written to a log next to the result. Nothing is sent anywhere else.curl -fsSL https://get.bareket.ai/pgdiscover | sh pgdiscover up 10.0.7.0/24 --credentials pwx-ro.cred --insecure - See what continuous monitoring adds: the Stack sandbox.
Free e-mail alerts
Get an e-mail when a new CVE lands for what you run
Run it on your own fleet
PWX Discover is free: the scan reads your fleet and lists what to fix, on your machine. PWX Monitor keeps watching every layer, from the tenant to the power rail, with attack paths and alerts in your SIEM. PWX Protect acts on the BMC. Start with a pilot.