DSA-2022-146: Dell Integrated Data Protection Appliance (PowerProtect DP Series) Security Update for iDRAC Component Vulnerability

Summary: Dell EMC Integrated Data Protection Appliance (PowerProtect DP Series) remediation is available for iDRAC that may be exploited by malicious users to compromise the affected system.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Impact

Critical

Details

Component CVE More information
iDRAC CVE-2021-36299 See Dell article 199267, DSA-2022-068: Dell iDRAC9 Security Update for an Improper Authentication Vulnerability 
Component CVE More information
iDRAC CVE-2021-36299 See Dell article 199267, DSA-2022-068: Dell iDRAC9 Security Update for an Improper Authentication Vulnerability 
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products & Remediation

Product Affected Versions Updated Versions Link to Update
Dell Integrated Data Protection Appliance 2.7.2, 2.7.1, 2.7.0, 2.6.x, 2.5, 2.4.x, 2.3.x, and 2.2 Patch Pending  
 
NOTE: IDPA disables VNC by default and is not vulnerable by default. This vulnerability impacts only 14G based IDPA systems that run on iDRAC9 and have enabled VNC. See workaround for steps on disabling VNC.

This DSA for CVE-2021-36299 is not cumulative and does not contain fixes to all previous security fixes mentioned in previously published DSAs. Sequence does not matter for applying this DSA. You can apply the workaround present in this DSA before or after applying any previous DSAs.
Product Affected Versions Updated Versions Link to Update
Dell Integrated Data Protection Appliance 2.7.2, 2.7.1, 2.7.0, 2.6.x, 2.5, 2.4.x, 2.3.x, and 2.2 Patch Pending  
 
NOTE: IDPA disables VNC by default and is not vulnerable by default. This vulnerability impacts only 14G based IDPA systems that run on iDRAC9 and have enabled VNC. See workaround for steps on disabling VNC.

This DSA for CVE-2021-36299 is not cumulative and does not contain fixes to all previous security fixes mentioned in previously published DSAs. Sequence does not matter for applying this DSA. You can apply the workaround present in this DSA before or after applying any previous DSAs.

Workarounds & Mitigations

Steps:

  1. Open a browser software, enter the IP address of your iDRAC interface, and access the administrative web interface.
  2. On the prompt screen, enter the administrative login information.
  3. After a successful login, the administrative menu is displayed.
  4. Access the Configuration menu, and choose Virtual Console option.
  5. At the top of the screen, go to VNC Server panel.
  6. Ensure that Enable VNC Server option is in Disabled state as shown in the screenshot below.
  7. If it is not Disabled, choose Disabled, Save, and Exit.
Screenshot of Disable VNC Server
Figure 1: Screenshot of Disable VNC Server
 
 

Revision History

RevisionDateDescription
1.02022-May-24Initial Release

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Disclaimer

Affected Products

PowerProtect Data Protection Software, Integrated Data Protection Appliance Family, PowerProtect Data Protection Hardware, Integrated Data Protection Appliance Software, Product Security Information
Article Properties
Article Number: 000200050
Article Type: Dell Security Advisory
Last Modified: 28 Jun 2023
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.