EUVD-2026-60175
GHSA-874c-8mxq-8cmm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Network-reachable iDRAC interface requires low-privilege credentials and a user interaction step; only limited confidentiality impact with no integrity or availability effect, consistent with residual memory read.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
3DescriptionCVE.org
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Dell iDRAC9 (prior to 7.20.30.50) and iDRAC10 (prior to 1.20.60.50) expose residual memory contents to low-privileged remote attackers due to improper memory sanitization classified under CWE-1330 (Remanent Data Readable after Memory Erase). Exploitation requires authenticated low-privilege access and user interaction, yielding limited confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis, and Dell has released patched firmware versions per advisory DSA-2026-348.
Technical ContextAI
Dell iDRAC (Integrated Dell Remote Access Controller) is a dedicated out-of-band management controller embedded in Dell PowerEdge servers, providing remote administration, monitoring, and lifecycle management fully independent of the host operating system. CWE-1330 (Remanent Data Readable after Memory Erase) describes a class of weakness where a memory-clearing or erase operation fails to fully sanitize a memory region, allowing residual data from prior use to remain readable by subsequent operations or privileged reads. In a BMC/management-plane context such as iDRAC, this is particularly sensitive because the controller handles operational data including credentials, session tokens, configuration parameters, and hardware telemetry. The vulnerability spans both iDRAC9 and iDRAC10 generations, as confirmed by Dell advisory DSA-2026-348, covering two distinct firmware codebases used across a broad range of Dell PowerEdge platforms.
RemediationAI
Dell has released patched firmware resolving this vulnerability: upgrade Dell iDRAC9 to version 7.20.30.50 or later, and Dell iDRAC10 to version 1.20.60.50 or later. Full upgrade instructions and firmware packages are documented in Dell advisory DSA-2026-348 at https://www.dell.com/support/kbdoc/en-us/000497902/dsa-2026-348-security-update-for-dell-idrac9-and-idrac10-vulnerability. As a compensating control prior to patching, restrict iDRAC network access to a dedicated out-of-band management VLAN accessible only to authorized administrators - this eliminates the network attack vector for users who should not hold iDRAC credentials, trading some operational convenience for a meaningfully reduced attack surface. Additionally, enforce least-privilege iDRAC account policies to ensure low-privilege roles are not granted unnecessarily, since PR:L is a required prerequisite for exploitation.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today