Skip to main content
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Some article numbers may have changed. If this isn't what you're looking for, try searching all articles. Search articles

Dell EMC iDRAC Multiple Vulnerabilities (CVE-2018-15774 and CVE-2018-15776)

Summary: Dell EMC guidance to mitigate risk and resolution for the iDRAC multiple vulnerabilities. For specific information on affected iDRAC versions and next steps to apply the updates, refer to this guide. ...

This article may have been automatically translated. If you have any feedback regarding its quality, please let us know using the form at the bottom of this page.

Article Content


CVE Identifier: CVE-2018-15774, CVE-2018-15776

Severity: Medium

Affected products:
  • Dell EMC iDRAC7/iDRAC8 versions prior to (CVE-2018-15774 and CVE-2018-15776)
  • Dell EMC iDRAC9 versions prior to,, and (CVE-2018-15774)
Dell EMC iDRAC has been updated to address multiple vulnerabilities which may potentially be exploited to compromise the affected systems.
  • Privilege Escalation Vulnerability (CVE-2018-15774)
Dell EMC iDRAC7/iDRAC8 versions prior to and iDRAC9 versions prior to,,, and contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access.
  • Improper Error Handling Vulnerability (CVE-2018-15776)
Dell EMC iDRAC7/iDRAC8 versions prior to contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.
SLN315190_en_US__1icon Note: Other models of iDRAC are not affected by the vulnerabilities detailed above.

The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:

iDRAC iDRAC firmware Version



SLN315190_en_US__1icon Note: Available as of the publication date.

Dell EMC recommends all customers upgrade at the earliest opportunity. 

Dell EMC Best Practices regarding iDRAC:

In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:

  • iDRACs are not designed nor intended to be placed on or connected to the internet; they are intended to be on a separate management network. Placing or connecting iDRACs directly to the internet could expose the connected system to security and other risks for which Dell EMC is not responsible.  
  • Along with locating iDRACs on a separate management subnet, users should isolate the management subnet/vLAN with technologies such as firewalls, and limit access to the subnet/vLAN to authorized server administrators.
  • Dell EMC recommends that customers take into account any deployment factors that may be relevant to their environment to assess their overall risk.

Link to remedies:

Customers can download iDRAC firmware for PowerEdge servers and for all other platforms, please select the platform from the Dell support site.


CVE-2018-15776: Dell EMC would like to thank Jon Sands and Adam Nielsen for reporting this issue to us.

Dell EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Dell EMC, or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.




Article Properties

Affected Product

Hyper-converged Systems, Datacenter Scalable Solutions, PowerEdge, iDRAC7/8 with Lifecycle Controller Version, Precision 7920 Rack, Precision Rack 7910

Last Published Date

17 Dec 2021



Article Type