Dell iDRAC9 (web interface, local file inclusion): A path-traversal / local-file-inclusion flaw lets a low-privilege

Impact

A path-traversal / local-file-inclusion flaw lets a low-privilege iDRAC user read files outside the intended directory on the BMC. The value to an attacker is escalation material - configuration, credentials and session data that upgrade a read-only monitoring account into real control of the service processor. This is the classic privilege-ladder rung: the account you handed to a monitoring agent becomes the account that owns the node's out-of-band plane.

Who can reach it

An authenticated low-privilege iDRAC operator or read-only account reaching the iDRAC web interface over the management VLAN. No host access needed.

What to do

Flash iDRAC9 to 4.20.20.20 or later - out-of-band, per-node, no host reboot, no drain. There is no clean config-only mitigation for this one beyond tightening who holds iDRAC accounts at all, so treat it as a firmware campaign. Worth pairing with an audit of low-privilege iDRAC service accounts, which are usually shared and rarely rotated.

References