Dell iDRAC10 firmware versions 1.20.70.50 and 1.30.05.10 contain a race condition that results in insufficiently protected credentials, as identified by CWE‑522. A user who already has low‑privileged authentication can trigger the race condition to obtain elevated access rights, effectively bypassing the intended credential safeguards. This escalation could allow the attacker to modify iDRAC settings, view or alter configuration files, and gain broader control over the host server, thereby compromising integrity and potentially confidentiality of sensitive host information.

Affected systems are Dell iDRAC10 interfaces running firmware versions 1.20.70.50 or 1.30.05.10. No other Dell iDRAC variants or firmware revisions are listed as vulnerable.

The vulnerability is rated a CVSS score of 7.1, indicating high risk, but no EPSS data is available to assess current exploit probability. The vulnerability is not listed in CISA's KEV catalog. The race condition requires an authenticated low‑privileged local account; therefore an attacker must have physical or remote access to the iDRAC interface and legitimate credentials. Exploitation would involve timing the credential verification routine to duplicate authentication tickets or tokens, thereby elevating privileges. While the exact implementational details are not fully documented, the referred Dell advisory indicates that the issue has been patched and should be addressed promptly.