How severe is CVE-2018-1249?

CVE-2018-1249 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2018-1249 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-1249?

CVE-2018-1249 affects Dell Idrac9 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-1249?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-1249 published?

CVE-2018-1249 was published on 2018-07-02 and last updated on 2026-06-17.

CVE-2018-1249

CVE-2018-1249 is a medium-severity vulnerability in Dell Idrac9 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.3
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Dell Idrac9 Firmware
Published: 2018-07-02
Last modified: 2026-06-17

Description

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.

Frequently asked questions

What is CVE-2018-1249?: Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.
How severe is CVE-2018-1249?: CVE-2018-1249 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2018-1249 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-1249?: CVE-2018-1249 affects Dell Idrac9 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-1249?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-1249 published?: CVE-2018-1249 was published on 2018-07-02 and last updated on 2026-06-17.

References

http://en.community.dell.com/techcenter/extras/m/white_papers/20487494

Affected products (1)

cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Idrac9 Firmware

CVE-2019-3705 — Critical (CVSS 9.8): Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to…
CVE-2021-21538 — Critical (CVSS 9.6): Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication…
CVE-2018-1244 — High (CVSS 8.8): Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command…
CVE-2019-3707 — High (CVSS 8.6): Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may…
CVE-2019-3706 — High (CVSS 8.6): Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass…
CVE-2018-1243 — High (CVSS 7.5): Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to…

All CVEs affecting Dell Idrac9 Firmware →