Dell · Vulnerability intelligence
Dell iDRAC
Our sources currently list 21 known vulnerabilities affecting Dell iDRAC. 2 are rated critical severity.
Last updated: 22 July 2026, 20:34 AEST
No current ASD advisory names this product.That describes the Australian Signals Directorate’s publication record — it is not a statement that this product is free of vulnerabilities. See the list below.
| CVE | Severity | Exploitation | Published | Summary |
|---|---|---|---|---|
| CVE-2019-3705 | Critical (9.8) | No exploitation reported | Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-b… | |
| CVE-2020-5344 | High (7.0) | No exploitation reported | Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may … | |
| CVE-2018-1244 | High (8.8) | No exploitation reported | Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated ma… | |
| CVE-2019-3706 | High (8.6) | No exploitation reported | Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this v… | |
| CVE-2019-3707 | High (8.6) | No exploitation reported | Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication a… | |
| CVE-2018-1243 | High (7.5) | No exploitation reported | Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sess… | |
| CVE-2020-5366 | High (7.1) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulner… | |
| CVE-2021-21538 | Critical (9.6) | No exploitation reported | Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploi… | |
| CVE-2021-21540 | Medium (5.9) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite… | |
| CVE-2020-26198 | Medium (6.1) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentiall… | |
| CVE-2018-15774 | Low (3.8) | No exploitation reported | Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An… | |
| CVE-2021-21544 | Low (2.7) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit … | |
| CVE-2018-1249 | Medium (6.5) | No exploitation reported | Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this v… | |
| CVE-2019-3764 | Medium (4.3) | No exploitation reported | Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote … | |
| CVE-2021-21541 | Medium (6.1) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability … | |
| CVE-2021-21543 | Medium (4.8) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentia… | |
| CVE-2021-21539 | Medium (5.9) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit th… | |
| CVE-2022-34435 | Low (2.7) | No exploitation reported | Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged at… | |
| CVE-2025-22397 | Medium (6.7) | No exploitation reported | Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Contro… | |
| CVE-2021-21542 | Medium (4.8) | No exploitation reported | Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentia… | |
| CVE-2025-26482 | Medium (4.9) | No exploitation reported | Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit … |
Vulnerability data from the NVD andCISA KEV(US Government, public domain); Australian advisories fromASD’s ACSC (CC BY 4.0). Exploit-probability scores from FIRST EPSS.
Let's talk
Running Dell iDRAC?
Our Newcastle team can audit your Dell estate, tell you in plain English which of these actually affect you, and patch them — fixed quote, no obligation.