CVE-2019-3764

MEDIUM

4.3

CVSS Score

Published: November 7, 2019 at 06:05 PM UTC

Updated: June 17, 2026 at 02:35 AM UTC

4 products affected across 1 vendorIDRAC9 FirmwareIDRAC8 FirmwareIDRAC7 Firmware

Using Integrated Dell Remote Access Controller (iDRAC) by Dell?

Get instant alerts when new vulnerabilities affect Integrated Dell Remote Access Controller (iDRAC) - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.9%

Description

Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IDRAC7 Firmware · Dell

95%

v < 2.65.65.65

Affected range stops below 2.65.65.65, so it looks safe — our inference, not a vendor statement

IDRAC8 Firmware · Dell

95%

v < 2.70.70.70

Affected range stops below 2.70.70.70, so it looks safe — our inference, not a vendor statement

IDRAC9 Firmware · Dell

95%

v < 3.36.36.36

Affected range stops below 3.36.36.36, so it looks safe — our inference, not a vendor statement

Integrated Dell Remote Access Controller (iDRAC)· Dell

60%

v < iDRAC7: 2.65.65.65, iDRAC8: 2.70.70.70, iDRAC9: 3.40.40.40 and 3.36.36.36

Affected range stops below iDRAC7: 2.65.65.65, iDRAC8: 2.70.70.70, iDRAC9: 3.40.40.40 and 3.36.36.36, so it looks safe — our inference, not a vendor statement