Vulnerability · Published Aug 3, 2021 · Assigned by dell
CVE-2021-21580
Medium 4.3
In plain English
A medium-severity injection in Integrated Dell Remote Access Controller (iDRAC) from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | Integrated Dell Remote Access Controller (iDRAC) | unspecified – before 5.00.00.00 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://www.dell.com/support/kbdoc/000189193 x_refsource_MISC