« Volver al listado

CVE-2013-4783

Estado: ModificadaAlta (10)—

The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — Idrac6 BMC

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4783",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-07-08T22:55:01.137",
  "references": [
    {
      "url": "ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://fish2.com/ipmi/cipherzero.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/show/osvdb/93039",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.wired.com/threatlevel/2013/07/ipmi/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.gnu.org/archive/html/freeipmi-devel/2013-02/msg00013.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://fish2.com/ipmi/cipherzero.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/show/osvdb/93039",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.wired.com/threatlevel/2013/07/ipmi/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.gnu.org/archive/html/freeipmi-devel/2013-02/msg00013.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.  NOTE: the vendor disputes the significance of this issue, stating \"DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet.\""
    },
    {
      "lang": "es",
      "value": "El dispositivo iDRAC6 de Dell con versiones de firmware 1.x anteriores a 1.92 y versiones 2.x y versiones 3.x anteriores a 3.42, e iDRAC7 con versión de firmware anterior a 1.23.23, permite a los atacantes remotos omitir la autenticación y ejecutar comandos IPMI arbitrarios usando el conjunto de cifrado 0 (también se conoce como cifrado cero) y una contraseña arbitraria. NOTA: el proveedor cuestiona la importancia de este problema, declarando que  \"Los DRAC están destinados a estar en una red de administración separada; no están diseñados ni destinados a ser conectados o conectados a Internet\"."
    }
  ],
  "lastModified": "2026-06-16T23:57:53.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dell:idrac6_bmc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3F5CD3D-EFF6-41DA-AB2F-FF172F5CD1FC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}