CVE-2018-1249

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.

Score

CVSS 3.0 6.5 Medium

Status

Modified - security_alert@emc.com

Published

2018-07-02

Last modified

2024-09-17

Affected products

• Idrac9 Firmware (Dell)
• Idrac9 (Dell Emc)

References

• http://en.community.dell.com/techcenter/extras/m/white_papers/20487494