CVE-2024-25943

iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability	Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:idrac9:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:dell:idrac9:*:*:*:*:*:*:*:*

History

03 Feb 2025, 15:24

Type	Values Removed	Values Added
First Time		Dell idrac9 Dell
CPE		cpe:2.3:a:dell:idrac9::::::::
References	~~() https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability -~~	() https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability - Vendor Advisory
CWE		NVD-CWE-noinfo

21 Nov 2024, 09:01

Type	Values Removed	Values Added
References	~~() https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability -~~	() https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability -

01 Jul 2024, 12:37

Type	Values Removed	Values Added
Summary		(es) iDRAC9, versiones anteriores a 7.00.00.172 para la 14.ª generación y 7.10.50.00 para las 15.ª y 16.ª generación, contiene una vulnerabilidad de secuestro de sesión en IPMI. Un atacante remoto podría explotar esta vulnerabilidad, lo que provocaría la ejecución de código arbitrario en la aplicación vulnerable.

29 Jun 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-29 13:15

Updated : 2025-02-03 15:24

NVD link : CVE-2024-25943

Mitre link : CVE-2024-25943

CVE.ORG link : CVE-2024-25943

JSON object : View

Products Affected

dell

idrac9

CWE

CWE-330

Use of Insufficiently Random Values

NVD-CWE-noinfo

{"id": "CVE-2024-25943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-29T13:15:10.403", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-330"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application."}, {"lang": "es", "value": "iDRAC9, versiones anteriores a 7.00.00.172 para la 14.\u00aa generaci\u00f3n y 7.10.50.00 para las 15.\u00aa y 16.\u00aa generaci\u00f3n, contiene una vulnerabilidad de secuestro de sesi\u00f3n en IPMI. Un atacante remoto podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la ejecuci\u00f3n de c\u00f3digo arbitrario en la aplicaci\u00f3n vulnerable."}], "lastModified": "2025-02-03T15:24:40.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:idrac9:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5779DFD-C507-4264-994A-D4B462F2276A", "versionEndExcluding": "7.00.00.172"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:idrac9:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "281F86D0-7B91-48EB-A83C-CDF53CC4744E", "versionEndExcluding": "7.10.50.00"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}

7.6 /10