PT-2021-14564 · Dell Emc · Dell Emc Integrated System For Microsoft Azure Stack Hub

Published 2021-05-06 · Updated 2022-10-24 · CVE-2021-21505

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated System for Microsoft Azure Stack Hub versions 1906 through 2011

Description The issue concerns an undocumented default iDRAC account in the system. A remote unauthenticated attacker, with knowledge of the default credentials, could potentially exploit this to log in to the system and gain root privileges.

Recommendations For versions 1906 through 2011, change the default iDRAC account credentials to prevent unauthorized access. As a temporary workaround, consider restricting access to the iDRAC account until a patch is available.

Fix

Weakness Enumeration

CWE-1188

CWE-255

Related Identifiers

CVE-2021-21505

Affected Products

Dell Emc Integrated System For Microsoft Azure Stack Hub

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-21505 · Security Note
• https://dell.com/support/kbdoc/en-us/000186008/dsa-2021-020-dell-emc-integrated-system-for-microsoft-azure-stack-hub-security-update-for-an-idrac-undocumented-account-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21505 · Vendor Advisory
• https://t.me/cvenotify/14532 · Telegram Post