CVE-2026-70412 in iDRAC10
Summary
by MITRE • 08/17/2026
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The identified security flaw resides within the firmware of Dell iDRAC9 versions prior to 7.20.30.50 and Dell iDRAC10 versions prior to 1.20.60.50, specifically affecting the memory management subsystem responsible for handling sensitive operational data. This vulnerability is classified as a Remanent Data Readable after Memory Erase issue, which indicates that when specific memory regions containing confidential information are deallocated or cleared by the system software, the underlying physical storage retains residual magnetic or electronic states of the previous contents. Consequently, subsequent allocation and read operations to these same memory addresses can retrieve data from prior sessions rather than returning null or zeroed values as expected in a secure implementation. This behavior creates a persistent side channel through which previously processed information remains accessible even after it has been logically erased by the operating system or firmware routines.
From an operational perspective, this vulnerability poses a significant risk to organizations relying on out-of-band management interfaces for server administration and monitoring. The iDRAC serves as a critical component in data center infrastructure, providing remote console access, hardware health monitoring, and power control capabilities. Because the flaw allows for information disclosure without requiring administrative privileges, any user with low-privileged remote access credentials can potentially exploit this condition to extract sensitive artifacts from memory. These artifacts may include session tokens, cryptographic keys, network configuration details, or other proprietary data that was processed during previous management sessions but not properly sanitized before being overwritten by new operations. The ability of an attacker to reconstruct these remnants effectively bypasses standard authentication and authorization controls designed to protect such information.
The exploitation vector for this vulnerability aligns with the ATT&CK technique T1074, specifically Data Staged or Local Data Stealing via memory scraping techniques that do not require elevated privileges if the application itself has access to the memory space. In the context of CWE taxonomy, this flaw corresponds directly to CWE-325: Missing Encryption of Sensitive Data in RAM and more broadly to CWE-147: Improper Cleanup of Temporary Files or Resources when considering the failure to properly sanitize volatile storage after use. The impact is primarily categorized under Confidentiality loss within the CIA triad, as the primary consequence is the unauthorized exposure of internal system states and credentials that should remain isolated from lower-level processes. Attackers leveraging this flaw can perform memory forensics against live systems or cached buffers to piece together a comprehensive picture of network topology and security configurations, facilitating further lateral movement or targeted attacks against higher-privileged accounts.
Mitigation strategies must prioritize the immediate application of vendor-provided firmware updates that address the underlying memory management logic. Dell has released updated versions for iDRAC9 at 7.20.30.50 and later, as well as iDRAC10 at 1.20.60.50 and later, which implement proper zeroization routines to ensure that all sensitive data is cryptographically destroyed or overwritten with random noise before memory blocks are returned to the free pool. In environments where immediate patching is not feasible due to operational constraints, organizations should enforce strict access control policies on iDRAC interfaces, ensuring that only authorized personnel possess remote login credentials and that these accounts utilize multi-factor authentication to reduce the attack surface. Additionally, network segmentation strategies can be employed to isolate management networks from general corporate or public-facing networks, thereby limiting the ability of low-privileged attackers to reach the vulnerable component remotely until a permanent fix is deployed. Regular auditing of firmware versions across all managed servers should also be implemented as part of routine vulnerability management programs to prevent exposure to such memory-related flaws in future updates.