Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-8272

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.

Published

2014-12-19T11:59:05.290

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dell	idrac6_modular	≤ 3.60	Yes
Application	dell	idrac7	≤ 1.56.55	Yes
Application	intel	ipmi	1.5	Yes
Application	dell	idrac6_monolithic	≤ 1.97	Yes

References

http://www.exploit-db.com/exploits/35770 Exploit ([email protected])
http://www.kb.cert.org/vuls/id/843044 Third Party Advisory, US Government Resource ([email protected])
http://www.kb.cert.org/vuls/id/BLUU-9RDQHM Third Party Advisory, US Government Resource ([email protected])
http://www.exploit-db.com/exploits/35770 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/843044 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/BLUU-9RDQHM Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)