Description

Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-17T13:16:52.737Z",
  "pubdate": "2026-08-17T13:16:52.737Z",
  "executiveSummary": "Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, are affected by a Remanent Data Readable after Memory Erase vulnerability. This security flaw involves improper memory sanitization, allowing sensitive data to persist in memory regions even after an explicit memory erase operation has been executed.\nThe primary impact of this vulnerability is unauthorized information disclosure, which may expose sensitive system artifacts, credentials, or operational data left resident in volatile or non-volatile storage components. The risk implication is significant as it undermines cryptographic and operational data hygiene routines, potentially exposing high-value configuration or runtime secrets.\nExploitation of this vulnerability requires a low-privileged attacker with remote access to the targeted management interface. The attacker must interact with specific system functions or diagnostic interfaces capable of querying or reading memory segments where remnants of prior operations persist.",
  "technicalDetails": "The vulnerability resides within the internal data handling and memory management subsystems of the Baseboard Management Controller (BMC). Specifically, the root cause stems from the failure of memory erase routines to fully overwrite or cryptographic-sanitize targeted memory allocations. Consequently, historical data structures, buffers, or state variables remain intact at the physical or logical memory offset post-eradication.\nThe vulnerable components comprise the firmware memory management and secure erase logic within Dell iDRAC9 prior to version 7.20.30.50 and Dell iDRAC10 prior to version 1.20.60.50. The affected architecture exposes these memory persistence issues over remote management protocols accessible to authenticated users.\nThe attack flow proceeds as follows: First, sensitive operations are executed on the targeted management controller, populating memory buffers with critical operational data or credentials. Second, an administrative or automated routine triggers a memory erase procedure designed to clear these sensitive artifacts. Due to the incomplete sanitization flaw, the data is retained in memory despite the execution of the erase command.\nIn the post-exploitation phase, a low-privileged authenticated attacker leverages remote access capabilities to interface with exposed APIs, diagnostic endpoints, or raw memory read primitives. By targeting the specific memory offsets or structures where residual data resides, the attacker retrieves the remanent information. This harvested data can subsequently be leveraged for lateral movement, privilege escalation, or further compromise of the underlying host infrastructure managed by the BMC."
}