Improper Input Validation in Dell iDRAC9 Firmware
CVE-2022-34435

2.7LOW

Key Information:

Vendor

Dell
Status
Integrated Dell Remote Access Controller 9
Vendor
CVE Published:
18 January 2023

What is CVE-2022-34435?

Dell iDRAC9 versions up to 6.00.02.00 are vulnerable due to improper input validation in the Racadm command-line utility when firmware lock-down is enabled. This weakness allows a remote attacker with elevated privileges to bypass the firmware lock-down and execute unauthorized firmware updates, potentially compromising the security and stability of affected devices. It's crucial for users to assess their systems and implement security measures to mitigate this vulnerability.

Affected Version(s)

Integrated Dell Remote Access Controller 9 0 <= 6.00.02.00

References

https://www.dell.com/support/kbdoc/000205346
vendor-advisory

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.