Idrac Tools
Monthly
Link-following (symlink attack) in Dell iDRAC Tools versions prior to 11.4.1.0 allows a low-privileged local attacker to redirect file operations to unintended targets, resulting in unauthorized modification of files (high integrity impact) and potential availability disruption. Exploitation requires both low-level local access and user interaction, placing this in a constrained attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and no EPSS score was supplied in source data.
Dell iDRAC Tools versions prior to 11.3.0.0 contain an improper access control vulnerability (CWE-284) that allows low-privileged local attackers to escalate privileges without user interaction. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact. While no CVE-2025-27689 entry exists in public KEV catalogs or active exploitation databases at this time, the local attack vector with low complexity and low privilege requirements indicates this is a practical privilege escalation risk for organizations running vulnerable iDRAC Tool versions on multi-user systems.
Link-following (symlink attack) in Dell iDRAC Tools versions prior to 11.4.1.0 allows a low-privileged local attacker to redirect file operations to unintended targets, resulting in unauthorized modification of files (high integrity impact) and potential availability disruption. Exploitation requires both low-level local access and user interaction, placing this in a constrained attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and no EPSS score was supplied in source data.
Dell iDRAC Tools versions prior to 11.3.0.0 contain an improper access control vulnerability (CWE-284) that allows low-privileged local attackers to escalate privileges without user interaction. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact. While no CVE-2025-27689 entry exists in public KEV catalogs or active exploitation databases at this time, the local attack vector with low complexity and low privilege requirements indicates this is a practical privilege escalation risk for organizations running vulnerable iDRAC Tool versions on multi-user systems.