CVE-2021-36347

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363488.1iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may CVE-2021-363494.3Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processin CVE-2021-36354.4A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able CVE-2021-363507.5Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A CVE-2021-363519.8SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear para CVE-2021-363525.4Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST reques CVE-2021-363569.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts a CVE-2021-363579.8An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, CVE-2021-363598.8OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platyp CVE-2021-36364.6It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional CVE-2021-363639.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.CVE-2021-363649.8Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.