Dell iDRAC7 / iDRAC8 (web server URI parser): Directory traversal in the BMC's own HTTP front end lets an attacker

Impact

Directory traversal in the BMC's own HTTP front end lets an attacker with no credentials read files off the iDRAC filesystem. In practice that is reconnaissance that turns into access: configuration, session material, and stored secrets that let the attacker come back as an authenticated user. Relevant to fleets that still run 12G/13G PowerEdge as head nodes, storage, or staging boxes alongside the GPU racks - the older tier tends to be the one nobody re-flashed.

Who can reach it

Anything routable to the iDRAC web port on the out-of-band management VLAN, unauthenticated. No host access and no valid account required.

What to do

Flash iDRAC7/iDRAC8 to 2.52.52.52 or later - out-of-band, per-node, no host reboot. On a fleet this old the real cost is inventory: finding which nodes are still on pre-2.52 firmware. Config-only interim: ACL the iDRAC web port to the jump hosts only. Note the original Dell TechCenter advisory URL is dead; NVD carries the authoritative version data.

References