Vulnerability record · CVE-2022-24422 · published 26 May 2022
CVE-2022-24422: Dell iDRAC9 improper authentication allows VNC console access
Dell · Idrac9
Dell iDRAC9 versions 5.00.00.00 through 5.10.10.00 contain an improper authentication flaw (CWE-287). A remote unauthenticated attacker can bypass authentication and reach the VNC Console, which is a management interface on a critical out-of-band controller.
Description
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network-reachable, unauthenticated access to a management console on a critical out-of-band controller, plus a very high EPSS score.
What it is
Dell iDRAC9 versions 5.00.00.00 through 5.10.10.00 contain an improper authentication flaw (CWE-287). A remote unauthenticated attacker can bypass authentication and reach the VNC Console, which is a management interface on a critical out-of-band controller.
Impact
An attacker gains access to the VNC Console without credentials, potentially viewing or controlling the managed server's console session. Given the CVSS vector (C:H/I:H/A:H), full compromise of confidentiality, integrity and availability is possible.
Attack surface
Reachable over the network via the iDRAC9 web/management interface (AV:N, AC:L). No authentication (PR:N) and no user interaction (UI:N) are required per the CVSS vector.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.57753 (99th percentile), indicating elevated likelihood of exploitation activity, but the record does not confirm active exploitation.
What to do
- Upgrade iDRAC9 to version 5.10.10.00 or later per Dell advisory DSA-2022-068.
- Restrict network access to iDRAC management interfaces to trusted management VLANs or jump hosts.
- Disable or restrict the VNC Console feature if it is not required.
- Monitor Dell advisories for updated firmware and re-apply if a revised fix is released.
Detection
- Review iDRAC audit logs for VNC console sessions initiated without prior authentication.
- Alert on unexpected inbound connections to iDRAC VNC ports from untrusted networks.
- Baseline and monitor iDRAC firmware versions to flag hosts below 5.10.10.00.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-24422 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-24422), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
