CVE-2021-36348

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-89 CWE-74

Affected software

Vendor	Product	Versions
Dell	Integrated Dell Remote Access Controller (iDRAC)	>= unspecified, < 5.00.20.00

References

https://www.dell.com/support/kbdoc/000194038Vendor Advisory
https://www.dell.com/support/kbdoc/000194038Vendor Advisory

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363494.3Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processin CVE-2021-36354.4A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able CVE-2021-363507.5Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A CVE-2021-363519.8SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear para CVE-2021-363525.4Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST reques CVE-2021-363569.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts a CVE-2021-363579.8An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, CVE-2021-363598.8OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platyp CVE-2021-36364.6It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional CVE-2021-363639.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.CVE-2021-363649.8Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.CVE-2021-363659.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.