CVE-2021-21544

Vulnerability

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges can manipulate the username field under the comment section and set the value to any user [1]. This affects all iDRAC9 versions before 4.40.00.00.

Exploitation

An attacker needs remote authenticated access with high privileges (e.g., administrator). They can then modify the username field in the comment section to impersonate any user. The exact sequence of steps is not publicly detailed but involves manipulating the comment functionality.

Impact

Successful exploitation allows the attacker to set the username field to any user, potentially leading to privilege escalation or impersonation. The impact is medium severity; the attacker gains the ability to misrepresent identity in comments, which could be used for social engineering or further attacks.

Mitigation

Dell released iDRAC9 version 4.40.00.00 to fix this vulnerability. Users should upgrade to this version or later. No workarounds are mentioned. The advisory is DSA-2021-073 [1].