CVE-2021-21578

Vulnerability

Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability [1]. An attacker can craft a malicious URL that, when visited by a victim, redirects the victim's browser to an arbitrary external website [1].

Exploitation

A remote unauthenticated attacker can exploit this vulnerability by tricking a victim into clicking a specially crafted link [1]. No authentication or network position beyond standard web access is required; the victim must perform the click action.

Impact

Successful exploitation allows an attacker to redirect a victim to an arbitrary web URL, potentially facilitating phishing attacks or delivering malicious content [1]. The CVSS base score is 6.1, indicating medium severity with low confidentiality and integrity impact, and scope change (C: low, I: low, A: none) [1].

Mitigation

The vulnerability is fixed in iDRAC9 version 4.40.40.00 [1]. Users should update to this or later versions. No workarounds are documented in the reference.