EUVD-2026-60175
GHSA-874c-8mxq-8cmm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Network-reachable iDRAC interface requires low-privilege credentials and a user interaction step; only limited confidentiality impact with no integrity or availability effect, consistent with residual memory read.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
3DescriptionCVE.org
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Dell iDRAC9 (prior to 7.20.30.50) and iDRAC10 (prior to 1.20.60.50) expose residual memory contents to low-privileged remote attackers due to improper memory sanitization classified under CWE-1330 (Remanent Data Readable after Memory Erase). Exploitation requires authenticated low-privilege access and user interaction, yielding limited confidentiality impact with no integrity or availability consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged iDRAC account (PR:L per CVSS), remote network access to the iDRAC management interface (AV:N), and some form of user interaction (UI:R) - the specific interaction is not detailed in available public data but likely involves navigating to or invoking a particular iDRAC UI page or API endpoint that triggers a read of an insufficiently erased memory region. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.5 Low score is internally consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), but gated behind low-privilege authentication (PR:L) and a required user interaction step (UI:R), with only limited confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Dell has released patched firmware resolving this vulnerability: upgrade Dell iDRAC9 to version 7.20.30.50 or later, and Dell iDRAC10 to version 1.20.60.50 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today