CVE-2018-1207: Dell EMC iDRAC CGI injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution on out-of-band management hardware with a 9.8 CVSS score and very high EPSS probability warrants immediate remediation.

What it is

Dell EMC iDRAC7 and iDRAC8 versions prior to 2.52.52.52 contain a CGI injection flaw (CWE-94) that permits remote code execution. Because the vulnerable interface is reachable without credentials, any network-adjacent attacker can attempt to run arbitrary code on the management controller. This matters because iDRAC is the out-of-band management plane, so compromise gives control beneath the host operating system.

Impact

An attacker gains remote code execution on the iDRAC management controller with high confidentiality, integrity and availability impact. That can expose credentials, allow firmware or configuration changes, and provide a foothold for lateral movement into managed servers.

Attack surface

The flaw is reached over the network via the iDRAC web/CGI interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use, but EPSS is very high at roughly 0.90 (99.8th percentile), indicating strong predicted exploitation activity. Reference tags are vendor and third-party advisories only, with no public exploit tag supplied.

What to do

• Upgrade iDRAC7/iDRAC8 firmware to version 2.52.52.52 or later as the primary fix.
• Restrict management network access to iDRAC interfaces with firewall rules and segmentation; never expose iDRAC to the internet.
• Disable or block unnecessary CGI endpoints and legacy web services on the controller where the platform allows.
• Rotate credentials and audit iDRAC accounts and logs for signs of tampering after any suspected exposure.
• Monitor Dell advisories for updated firmware guidance on affected iDRAC7/iDRAC8 builds.

Detection

• Review iDRAC web server and CGI access logs for anomalous or malformed CGI parameter requests.
• Alert on unexpected outbound connections or process activity originating from management controllers.
• Monitor for unauthorized iDRAC configuration, account or firmware changes.
• Baseline iDRAC firmware versions across the fleet and flag any host still below 2.52.52.52.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.