CVE-2018-1207

EPSS 90.8%◆ VulnCheck KEV

Vexday Risk Score

82Fix now

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Popular PoC on GitHub (18 stars) — exploitation code widely available.

CVSS —EPSS 90.8%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

23 Mar 2018Published on NVD

09 Dec 2021Public PoC

Weaponization speed

1356 daysto first PoC

Recommendation: Patch as soon as possible — active exploitation confirmed.

Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.

Affected products

n/a · n/a

public PoCs found — 6

githubgithub.com/mgargiullo/cve-2018-1207★ 18 githubgithub.com/hironull/CVE-2018-1207-better★ 0 exploitdbwww.exploit-db.com/exploits/52246unverified vulncheckvulncheck.com/xdb/0a0735b361d0unverified vulncheckvulncheck.com/xdb/ab5fd373cd47unverified vulncheckvulncheck.com/xdb/b29573f20548unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://en.community.dell.com/techcenter/extras/m/white_papers/20485410 https://twitter.com/nicowaisman/status/977279766792466432 http://www.securityfocus.com/bid/103694