iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability

Vulnerability

Dell EMC iDRAC7 and iDRAC8 firmware versions prior to 2.61.60.60, and iDRAC9 firmware versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability [1]. The flaw resides in a permissions check within the Redfish interface, where an authenticated user with operator privileges is incorrectly allowed to perform actions that should require administrator access [1].

Exploitation

An attacker must already have valid iDRAC credentials with operator-level privileges and be able to reach the Redfish API over the network. No additional user interaction is required. By sending crafted HTTP requests to the Redfish endpoint, the attacker can trigger the flawed permission check and execute operations reserved for the administrator role [1].

Impact

Successful exploitation grants the attacker complete administrative control over the iDRAC. This allows full management of the host system, including power operations, virtual media mounting, firmware updates, and configuration changes. The compromise of iDRAC can lead to further compromise of the underlying server [1].

Mitigation

Dell EMC has released fixed firmware versions: iDRAC7/8 version 2.61.60.60 and iDRAC9 versions 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 [1]. Administrators should upgrade to these versions or later as soon as possible. No workarounds are documented [1].