CVE-2018-15776 - OpenCVE

Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.

No CVSS v4.0

No CVSS v3.1

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dell	Idrac7 Firmware Idrac8 Firmware

Configuration 1 [-]

OR	cpe:2.3:o:dell:idrac7_firmware::::::::
	cpe:2.3:o:dell:idrac8_firmware::::::::

No data.

References

Link	Providers
http://www.securityfocus.com/bid/106233
https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en

History

Mon, 16 Sep 2024 23:00:00 +0000

Type	Values Removed	Values Added
Title	iDRAC7, iDRAC8 - Improper Error Handling	iDRAC7, iDRAC8 - Improper Error Handling

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2018-12-13T22:00:00Z

Updated: 2024-09-16T22:56:03.854Z

Reserved: 2018-08-23T00:00:00

Link: CVE-2018-15776

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-12-13T22:29:00.377

Modified: 2020-08-24T17:37:01.140

Link: CVE-2018-15776

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "iDRAC", "vendor": "Dell EMC", "versions": [{"lessThan": "2.61.60.60", "status": "affected", "version": "iDRAC7", "versionType": "custom"}, {"lessThan": "2.61.60.60", "status": "affected", "version": "iDRAC8", "versionType": "custom"}]}], "datePublic": "2018-12-11T00:00:00", "descriptions": [{"lang": "en", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Improper Error Handling Vulnerability.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-19T10:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}, {"name": "106233", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106233"}], "source": {"discovery": "UNKNOWN"}, "title": "iDRAC7, iDRAC8 - Improper Error Handling", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2018-12-11T06:00:00.000Z", "ID": "CVE-2018-15776", "STATE": "PUBLIC", "TITLE": "iDRAC7, iDRAC8 - Improper Error Handling"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "iDRAC", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "iDRAC7", "version_value": "2.61.60.60"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC8", "version_value": "2.61.60.60"}]}}]}, "vendor_name": "Dell EMC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Error Handling Vulnerability."}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en", "refsource": "CONFIRM", "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}, {"name": "106233", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106233"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T10:01:54.552Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}, {"name": "106233", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106233"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2018-15776", "datePublished": "2018-12-13T22:00:00Z", "dateReserved": "2018-08-23T00:00:00", "dateUpdated": "2024-09-16T22:56:03.854Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:idrac7_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACBCB009-3BF0-48D8-9F79-7466D3337F72", "versionEndExcluding": "2.61.60.60", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:idrac8_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B452829A-3012-44C8-B0EB-176CD61DEE07", "versionEndExcluding": "2.61.60.60", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell."}, {"lang": "es", "value": "Dell EMC iDRAC7/iDRAC8 en versiones anteriores a la 2.61.60.60 contiene una vulnerabilidad de manejo incorrecto de errores. Un atacante no autenticado con acceso f\u00edsico al sistema podr\u00eda explotar esta vulnerabilidad para obtener acceso al shell u-boot."}], "id": "CVE-2018-15776", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2018-12-13T22:29:00.377", "references": [{"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106233"}, {"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}