{"id":"CVE-2022-24422","published":"2022-05-26T15:20:22Z","modified":"2024-09-16T22:31:28Z","title":"Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability","vendor":"Dell","product":"Integrated Dell Remote Access Controller 9","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell","product":"Integrated Dell Remote Access Controller 9","versions":[">= unspecified, < 5.10.10.00"]}],"description":{"text":"Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.","provenance":"source","from":"CVE.org"},"summary":{"text":"Dell's Integrated Dell Remote Access Controller 9 (iDRAC9) contains an improper authentication flaw in its authentication handling. The issue is present in the iDRAC9 firmware branch covered by the affected version range. A remote attacker with network access to the controller and no credentials, and with user interaction required, may be able to gain access to the VNC Console.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:00Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.5854,"percentile":0.99097,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Dell EMC iDRAC9 security Bypass Vulnerability","url":"https://otx.alienvault.com/pulse/6282733cbfda0de9d6760010","created":"2022-05-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000199267/dsa-2022-068-dell-idrac9-security-update-for-an-improper-authentication-vulnerability","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-29314","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29314","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-05-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-24422","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":27.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9910"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}