CVE-2018-1207

🗓️ 23 Mar 2018 14:00:00Reported by dellType

cve🔗 web.nvd.nist.gov👁 156 Views🌐 WEB

Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, CGI injection vulnerability

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2018-1207	17 Apr 202521:02	–	circl
CNVD	Dell EMC iDRAC7 and iDRAC8 Code Execution Vulnerabilities	27 Mar 201800:00	–	cnvd
Cvelist	CVE-2018-1207	23 Mar 201814:00	–	cvelist
Tenable Nessus	Dell iDRAC Products Multiple Vulnerabilities (Mar 2018)	20 Apr 201800:00	–	nessus
Tenable Nessus	Dell EMC Code Injection (CVE-2018-1207)	17 Jan 202400:00	–	nessus
Exploit DB	Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)	16 Apr 202500:00	–	exploitdb
canvas	Immunity Canvas: IDRAC_APPWEB_RCE	23 Mar 201814:29	–	canvas
Nuclei	Dell iDRAC7/8 Devices - Remote Code Injection	25 Jun 202601:31	–	nuclei
NVD	CVE-2018-1207	23 Mar 201814:29	–	nvd
OSV	CVE-2018-1207	23 Mar 201814:29	–	osv

NVD

Node

dell emc_idrac7Range<2.52.52.52

dell emc_idrac8Range<2.52.52.52

Source	Link
twitter	www.twitter.com/nicowaisman/status/977279766792466432
en	www.en.community.dell.com/techcenter/extras/m/white_papers/20485410
securityfocus	www.securityfocus.com/bid/103694

Parameter	Position	Path	Description	CWE
LD_DEBUG	query param	cgi-bin/login?LD_DEBUG=files	Vulnerability check endpoint using LD_DEBUG to reveal vulnerable CGI path	CWE-94
binary payload	upload data	cgi-bin/putfile	Upload of a shared library/exploit via CGI injection vulnerability to achieve RCE	CWE-94
LD_PRELOAD	query param	cgi-bin/discover?LD_PRELOAD=/tmp/sshpkauthupload.tmp	Trigger remote code execution by LD_PRELOAD manipulation	CWE-94

17 Jun 2026 01:50Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 39.8

EPSS0.9079