{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adellemc_idrac8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dell:integrated_dell_remote_access_controller_7:*:*:*:*:*:*:*:*","cpe:2.3:a:dell:integrated_dell_remote_access_controller_8:*:*:*:*:*:*:*:*","cpe:2.3:a:dell:emc_idrac7:*:*:*:*:*:*:*:*","cpe:2.3:a:dell:emc_idrac8:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2018-1207"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iDRAC7 (\u003c 2.52.52.52)","iDRAC8 (\u003c 2.52.52.52)"],"_cs_severities":["critical"],"_cs_tags":["cve-2018-1207","rce","idrac","remote-code-execution","firmware-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Dell"],"content_html":"\u003cp\u003eDell iDRAC7 and iDRAC8 firmware versions 2.52.52.52 and below are vulnerable to a critical remote code execution (RCE) flaw tracked as CVE-2018-1207. The vulnerability exists within the web management interface, which fails to sanitize input parameters, allowing an attacker to manipulate environment variables for the dynamic linker. By leveraging the \u003ccode\u003eLD_DEBUG\u003c/code\u003e and \u003ccode\u003eLD_PRELOAD\u003c/code\u003e variables, an attacker can force the iDRAC web server process to load a malicious shared object (\u003ccode\u003e.so\u003c/code\u003e) file. Exploitation grants the attacker full root-level control over the management controller. The recent publication of functional PoC exploit scripts significantly increases the risk for organizations running legacy Dell PowerEdge server hardware that has not been updated to the recommended firmware versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker probes the target iDRAC web interface at \u003ccode\u003e/cgi-bin/login\u003c/code\u003e using the \u003ccode\u003eLD_DEBUG=files\u003c/code\u003e query parameter to confirm the device is vulnerable by observing debug output.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a malicious C payload designed to spawn a reverse shell.\u003c/li\u003e\n\u003cli\u003eThe payload is cross-compiled for the SH4 architecture using \u003ccode\u003esh4-linux-gnu-gcc\u003c/code\u003e to produce a malicious shared object (\u003ccode\u003e.so\u003c/code\u003e) file.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads the malicious library to the target device by sending a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/cgi-bin/putfile\u003c/code\u003e endpoint, which writes the file to \u003ccode\u003e/tmp/sshpkauthupload.tmp\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers execution by sending a \u003ccode\u003eGET\u003c/code\u003e request to \u003ccode\u003e/cgi-bin/discover\u003c/code\u003e with the \u003ccode\u003eLD_PRELOAD\u003c/code\u003e environment variable set to the path of the uploaded library (\u003ccode\u003e/tmp/sshpkauthupload.tmp\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe iDRAC dynamic linker loads the malicious library before the application initializes, triggering the \u003ccode\u003econstructor\u003c/code\u003e function within the library.\u003c/li\u003e\n\u003cli\u003eThe injected code executes with root privileges, establishing a reverse shell connection back to the attacker-controlled listener.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain complete control over the iDRAC management controller. This leads to full system compromise, as the attacker can manipulate hardware power states, access stored data, exfiltrate credentials, and potentially pivot into the host operating system or the wider data center network. The vulnerability is highly exploitable, and the widespread use of iDRAC in enterprise environments makes this a significant risk for server infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of all internet-facing or vulnerable internal iDRAC interfaces.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all affected Dell iDRAC7 and iDRAC8 devices to firmware version 2.52.52.52 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation to ensure iDRAC management interfaces are only accessible via trusted, restricted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/cgi-bin/putfile\u003c/code\u003e and \u003ccode\u003eGET\u003c/code\u003e requests containing \u003ccode\u003eLD_DEBUG\u003c/code\u003e or \u003ccode\u003eLD_PRELOAD\u003c/code\u003e query parameters.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts at exploiting the dynamic linker injection path.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-12T17:50:38Z","date_published":"2026-09-12T17:50:38Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2018-1207-idrac-rce/","summary":"CVE-2018-1207 allows unauthenticated attackers to achieve root-level remote code execution on Dell iDRAC7 and iDRAC8 firmware versions 2.52.52.52 and below via dynamic linker injection.","title":"Remote Code Execution in Dell iDRAC7 and iDRAC8","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2018-1207-idrac-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:dell:emc_idrac8:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}