CVE-2024-25943: Dell iDRAC9 RCE Vulnerability

CVE-2024-25943 Overview

CVE-2024-25943 is a session hijacking vulnerability affecting Dell iDRAC9 (Integrated Dell Remote Access Controller 9), a critical out-of-band management platform used to manage Dell PowerEdge servers remotely. The vulnerability exists within the IPMI (Intelligent Platform Management Interface) implementation in iDRAC9 firmware. A remote attacker could potentially exploit this vulnerability to hijack active management sessions, leading to arbitrary code execution on the vulnerable application.

This vulnerability poses significant risk to enterprise environments as iDRAC9 is commonly deployed in data centers to provide remote server management capabilities, including power control, virtual console access, and firmware updates. Successful exploitation could grant attackers complete control over server infrastructure without requiring physical access.

Critical Impact

Remote attackers can exploit weak session randomness in IPMI to hijack management sessions and execute arbitrary code on Dell iDRAC9 controllers, potentially compromising entire server infrastructure.

Affected Products

• Dell iDRAC9 versions prior to 7.00.00.172 for 14th Generation PowerEdge servers
• Dell iDRAC9 versions prior to 7.10.50.00 for 15th Generation PowerEdge servers
• Dell iDRAC9 versions prior to 7.10.50.00 for 16th Generation PowerEdge servers

Discovery Timeline

• 2024-06-29 - CVE-2024-25943 published to NVD
• 2025-02-03 - Last updated in NVD database

Technical Details for CVE-2024-25943

Vulnerability Analysis

The vulnerability stems from insufficient randomness in session identifier generation within the IPMI protocol implementation. IPMI is a standardized interface for out-of-band management that allows administrators to monitor and control servers independently of the operating system. When session tokens are generated with predictable or weak random values, attackers can potentially guess or calculate valid session identifiers.

The CWE-330 (Use of Insufficiently Random Values) classification indicates that the session handling mechanism does not generate adequately unpredictable session identifiers. This weakness allows attackers to predict or brute-force session tokens, enabling them to impersonate legitimate administrators and gain unauthorized access to the management interface.

Once an attacker hijacks an active iDRAC9 session, they can perform any action available to the legitimate administrator, including executing commands, modifying firmware, accessing virtual console, and controlling server power states. The ability to achieve arbitrary code execution means attackers could potentially install persistent backdoors or pivot to other systems within the network.

Root Cause

The root cause is improper implementation of session token generation in the IPMI subsystem, specifically the use of insufficiently random values (CWE-330). Cryptographically secure random number generation is essential for session management to prevent attackers from predicting session identifiers. The vulnerable versions fail to implement adequate entropy sources or secure random generation algorithms for IPMI session tokens.

Attack Vector

The attack can be conducted remotely over the network without requiring authentication or user interaction. An attacker with network access to the iDRAC9 management interface can:

1. Monitor IPMI traffic to observe session patterns and timing
2. Analyze the session token generation algorithm to identify weaknesses
3. Predict or brute-force valid session identifiers based on insufficient randomness
4. Hijack an active administrator session by injecting traffic with a guessed session ID
5. Execute arbitrary commands with the hijacked session's privileges

The attack does not require prior authentication, making it particularly dangerous for iDRAC9 interfaces exposed to untrusted networks. The vulnerability affects the IPMI interface typically accessible on UDP ports 623 (IPMI/RMCP) and the associated TCP management ports.

Detection Methods for CVE-2024-25943

Indicators of Compromise

• Unexpected administrative actions in iDRAC9 audit logs without corresponding legitimate administrator activity
• Multiple IPMI session requests from unusual IP addresses or geographic locations
• Anomalous session token patterns in network traffic analysis
• Firmware modifications or configuration changes during non-maintenance windows

Detection Strategies

• Deploy network intrusion detection signatures to identify IPMI session anomalies and brute-force attempts
• Enable comprehensive audit logging on all iDRAC9 controllers and forward logs to a centralized SIEM
• Monitor for unusual IPMI traffic patterns, particularly rapid session enumeration attempts
• Implement baseline analysis to detect deviation from normal administrative access patterns

Monitoring Recommendations

• Configure alerting for failed authentication attempts and session establishment failures on iDRAC9
• Monitor UDP port 623 and TCP management ports for unexpected connection sources
• Implement network segmentation monitoring to detect lateral movement from compromised management networks
• Review iDRAC9 session logs regularly for signs of session hijacking or unauthorized access

How to Mitigate CVE-2024-25943

Immediate Actions Required

• Update iDRAC9 firmware immediately to version 7.00.00.172 or later for 14th Generation servers
• Update iDRAC9 firmware to version 7.10.50.00 or later for 15th and 16th Generation servers
• Isolate iDRAC9 management interfaces on dedicated management VLANs with strict access controls
• Audit current iDRAC9 sessions and terminate any suspicious active sessions

Patch Information

Dell has released security updates addressing this vulnerability as documented in Dell Security Update DSA-2024-099. Organizations should download and apply the appropriate firmware version for their PowerEdge server generation:

• 14th Generation PowerEdge: iDRAC9 firmware version 7.00.00.172 or later
• 15th Generation PowerEdge: iDRAC9 firmware version 7.10.50.00 or later
• 16th Generation PowerEdge: iDRAC9 firmware version 7.10.50.00 or later

Firmware updates can be applied through the iDRAC9 web interface, Dell OpenManage Enterprise, or Dell Repository Manager.

Workarounds

• Restrict network access to iDRAC9 interfaces using firewall rules to allow only trusted management IP addresses
• Implement VPN requirements for all out-of-band management access
• Disable IPMI over LAN if not required for operational needs
• Enable iDRAC9 IP blocking feature to automatically block IPs after failed authentication attempts
• Consider using iDRAC9 lockdown mode during non-maintenance periods to prevent configuration changes