Sign-up

ID

VAR-202104-0679


CVE

CVE-2021-21539


TITLE

Dell EMC iDRAC9 Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202104-2280

DESCRIPTION

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. DELL Dell EMC iDRAC9 is a set of system management solutions including hardware and software from Dell (DELL). This solution provides functions such as remote management, crash recovery and power control for Dell PowerEdge systems

Trust: 1.08

sources: NVD: CVE-2021-21539 // VULHUB: VHN-379943 // VULMON: CVE-2021-21539

AFFECTED PRODUCTS

vendor:dellmodel:idrac9scope:ltversion:4.40.00.00

Trust: 1.0

sources: NVD: CVE-2021-21539

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-21539
value: HIGH

Trust: 1.0

security_alert@emc.com: CVE-2021-21539
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202104-2280
value: HIGH

Trust: 0.6

VULHUB: VHN-379943
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-21539
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-21539
severity: MEDIUM
baseScore: 4.6
vectorString: AV:N/AC:H/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-379943
severity: MEDIUM
baseScore: 4.6
vectorString: AV:N/AC:H/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-21539
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

security_alert@emc.com: CVE-2021-21539
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 1.2
impactScore: 4.7
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-379943 // VULMON: CVE-2021-21539 // CNNVD: CNNVD-202104-2280 // NVD: CVE-2021-21539 // NVD: CVE-2021-21539

PROBLEMTYPE DATA

problemtype:CWE-367

Trust: 1.1

sources: VULHUB: VHN-379943 // NVD: CVE-2021-21539

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202104-2280

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-2280

PATCH

title:Dell EMC iDRAC9 Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149945

Trust: 0.6

sources: CNNVD: CNNVD-202104-2280

EXTERNAL IDS

db:NVDid:CVE-2021-21539

Trust: 1.8

db:CNNVDid:CNNVD-202104-2280

Trust: 0.6

db:VULHUBid:VHN-379943

Trust: 0.1

db:VULMONid:CVE-2021-21539

Trust: 0.1

sources: VULHUB: VHN-379943 // VULMON: CVE-2021-21539 // CNNVD: CNNVD-202104-2280 // NVD: CVE-2021-21539

REFERENCES

url:https://www.dell.com/support/kbdoc/000185293

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-21539

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/367.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-379943 // VULMON: CVE-2021-21539 // CNNVD: CNNVD-202104-2280 // NVD: CVE-2021-21539

SOURCES

db:VULHUBid:VHN-379943
db:VULMONid:CVE-2021-21539
db:CNNVDid:CNNVD-202104-2280
db:NVDid:CVE-2021-21539

LAST UPDATE DATE

2024-08-14T14:25:24.984000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-379943date:2021-05-10T00:00:00
db:VULMONid:CVE-2021-21539date:2021-05-10T00:00:00
db:CNNVDid:CNNVD-202104-2280date:2021-05-11T00:00:00
db:NVDid:CVE-2021-21539date:2021-05-10T18:09:51.187

SOURCES RELEASE DATE

db:VULHUBid:VHN-379943date:2021-04-30T00:00:00
db:VULMONid:CVE-2021-21539date:2021-04-30T00:00:00
db:CNNVDid:CNNVD-202104-2280date:2021-04-30T00:00:00
db:NVDid:CVE-2021-21539date:2021-04-30T21:15:08.707