String Injection Vulnerability in Dell iDRAC7 and iDRAC8 Products
CVE-2016-5685

8.8HIGH

Key Information:

Vendor

Dell
Status
Idrac7 And Idrac8
Vendor
CVE Published:
29 November 2016

What is CVE-2016-5685?

Dell's iDRAC7 and iDRAC8 devices with firmware versions prior to 2.40.40.40 are susceptible to a string injection vulnerability, which allows authenticated users to execute arbitrary commands via a Bash shell. This can lead to unauthorized access and potential control of the devices, posing significant security risks for managed systems.

Affected Version(s)

iDRAC7 and iDRAC8 firmware before 2.40.40.40

References

http://en.community.dell.com/techcenter/extras/m/white_pa...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/94585
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.