Dell iDRAC9 (web interface, local file inclusion): A path-traversal / local-file-inclusion flaw lets a low-privilege

CVSS 7.1CVE-2020-5366Firmware, BMC & network fabricDSA-2020-128curated

Impact

A path-traversal / local-file-inclusion flaw lets a low-privilege iDRAC user read files outside the intended directory on the BMC. The value to an attacker is escalation material - configuration, credentials and session data that upgrade a read-only monitoring account into real control of the service processor. This is the classic privilege-ladder rung: the account you handed to a monitoring agent becomes the account that owns the node's out-of-band plane.

Who can reach it

An authenticated low-privilege iDRAC operator or read-only account reaching the iDRAC web interface over the management VLAN. No host access needed.

What to do

Flash iDRAC9 to 4.20.20.20 or later - out-of-band, per-node, no host reboot, no drain. There is no clean config-only mitigation for this one beyond tightening who holds iDRAC accounts at all, so treat it as a firmware campaign. Worth pairing with an audit of low-privilege iDRAC service accounts, which are usually shared and rarely rotated.

References

https://www.dell.com/support/article/en-us/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en https://nvd.nist.gov/vuln/detail/CVE-2020-5366

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.