Unscored severity · published Jul 8, 2013
CVE-2013-4785
The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request…
–
CVSS
3.6%
EPSS
No
On KEV
Description
The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request to an unspecified form that is accessible from testurls.html. NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Idrac6 Firmware · Dell
1.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4785
en.community.dell.com
http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx
fish2.com
http://fish2.com/ipmi/dell/secret.html
More from Idrac6 Firmware
9.8
CVE-2019-3705
Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a…
7.5
CVE-2018-1243
Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability
–
CVE-2013-3589
Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with…