Auth bypass in Dell Idrac6 Bmc
CVE-2013-4783
The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."
Vulnerability class: Broken Authentication
EPSS: 0.034 (87.6th percentile) — read the EPSS interpretation.
Affected products
- Dell Idrac6_bmc
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2013-4783?
- CVE-2013-4783 is a vulnerability in Dell Idrac6 Bmc, classified under Improper Authentication. Published 2013-07-08.
- Is CVE-2013-4783 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.