CVE-2018-1207

🗓️ 23 Mar 2018 14:00:00Reported by dellType

cve🔗 web.nvd.nist.gov👁 228 Views🌐 WEB

Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, CGI injection vulnerability

Reporter	Title	Published	Views	Family All 19
GithubExploit	Exploit for Code Injection in Dell Emc_Idrac7	9 Dec 202123:47	–	githubexploit
Circl	CVE-2018-1207	17 Apr 202521:02	–	circl
CNVD	Dell EMC iDRAC7 and iDRAC8 Code Execution Vulnerabilities	27 Mar 201800:00	–	cnvd
Cvelist	CVE-2018-1207	23 Mar 201814:00	–	cvelist
Tenable Nessus	Dell iDRAC Products Multiple Vulnerabilities (Mar 2018)	20 Apr 201800:00	–	nessus
Tenable Nessus	Dell EMC Code Injection (CVE-2018-1207)	17 Jan 202400:00	–	nessus
Exploit DB	Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)	16 Apr 202500:00	–	exploitdb
canvas	Immunity Canvas: IDRAC_APPWEB_RCE	23 Mar 201814:29	–	canvas
Kitploit	CVE-2018-1207-better	4 Oct 202620:03	–	kitploit
Kitploit	cve-2018-1207	2 Oct 202621:25	–	kitploit

NVD

Node

dell emc_idrac7Range<2.52.52.52

dell emc_idrac8Range<2.52.52.52

Source	Link
twitter	www.twitter.com/nicowaisman/status/977279766792466432
en	www.en.community.dell.com/techcenter/extras/m/white_papers/20485410
securityfocus	www.securityfocus.com/bid/103694

Parameter	Position	Path	Description	CWE
LD_DEBUG	query param	/cgi-bin/login	CVE-2018-1207 CGI injection vulnerability in iDRAC login endpoint triggered via LD_DEBUG parameter.	CWE-94
payload	upload data	/cgi-bin/putfile	File upload vector used to upload a malicious shared library exploited by the CGI injection.	CWE-94
LD_PRELOAD	query param	/cgi-bin/discover	CGI injection vector using LD_PRELOAD to execute uploaded library.	CWE-94

17 Jun 2026 01:50Current

9.6Critical risk

Vulners AI Score9.6

CVSS 27.5

CVSS 39.8

EPSS0.90091