CVE-2019-3706 Web Interface Authentication Bypass Vulnerability
Remote attackers can bypass authentication on Dell iDRAC web interfaces to gain unauthorized system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3706?
CVE-2019-3706 is a high-severity authentication bypass vulnerability in Dell EMC iDRAC, published on 26 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted data to the iDRAC web interface.
Which versions are affected by CVE-2019-3706?
It affects 1 product.
Products include Dell Idrac9 Firmware.
How do I fix CVE-2019-3706?
No fix has been published for CVE-2019-3706 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-3706 being exploited?
There is no known exploitation of CVE-2019-3706 in the wild and no public exploit code.
Other vulnerabilities in Dell EMC iDRAC
- CVE-2021-21538 Auth bypass in Integrated Dell Remote Access Controller (iDRAC)
- CVE-2019-3707 WS-MAN Authentication Bypass Vulnerability
- CVE-2020-5366 Path traversal in Integrated Dell Remote Access Controller (iDRAC)
- CVE-2018-1249 Security feature bypass in iDRAC9
- CVE-2021-21541 Cross-site scripting in Integrated Dell Remote Access Controller (iDRAC)
Sources
Also known as GHSA-x43r-h4j8-j6gq.