CVE-2025-26482: Dell PowerEdge R770 Information Disclosure

CVE-2025-26482 Overview

CVE-2025-26482 is an information disclosure vulnerability affecting Dell PowerEdge Server BIOS and Dell iDRAC9 across all versions. The flaw allows a remote attacker with high privileges to access sensitive information from affected server firmware. Dell has published advisory DSA-2025-046 addressing the issue, which impacts a broad range of PowerEdge servers, EMC XC Core systems, and iDRAC9 management controllers. The vulnerability is tracked under [CWE-1258] (Exposure of Sensitive System Information Due to Uncleared Debug Information).

Critical Impact
A high-privileged remote attacker can extract sensitive information from Dell PowerEdge BIOS and iDRAC9, potentially exposing firmware-level data that supports further attacks against out-of-band management infrastructure.

Affected Products

Dell PowerEdge Server BIOS (all versions across R240–R7725, T140–T640, XR, XE, C, MX, and HS product lines)
Dell iDRAC9 firmware (all versions)
Dell EMC XC Core and XC Core storage systems (XC450, XC640, XC650, XC660, XC750, XC760, XC940, XC7525, XC7625, NX440, NX3240, NX3340)

Discovery Timeline

2025-09-25 - CVE-2025-26482 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26482

Vulnerability Analysis

The vulnerability resides in the BIOS and iDRAC9 firmware present on Dell PowerEdge servers. iDRAC9 is Dell's integrated Baseboard Management Controller (BMC) used for out-of-band server management, providing remote KVM, virtual media, power control, and firmware update capabilities. An attacker with high-privileged access over the network can exploit the flaw to disclose sensitive information without impacting integrity or availability. The scope is unchanged, meaning the disclosure stays within the compromised iDRAC9 or BIOS security boundary. Because iDRAC9 typically holds credentials, cryptographic material, and platform configuration, any leakage from this component can accelerate broader compromise of the underlying server and adjacent management network.

Root Cause

Dell's advisory maps the issue to [CWE-1258], which describes exposure of sensitive system information due to uncleared debug information or hardware state that remains accessible after the manufacturing or debug phase. In practical terms, protected data within the BIOS or iDRAC9 execution context is reachable through interfaces that should sanitize or restrict it when operating in production mode.

Attack Vector

Exploitation requires network reachability to the iDRAC9 management interface and valid high-privileged credentials, such as an administrative iDRAC account. No user interaction is required. Once authenticated, the attacker issues management-plane requests that return firmware-resident information the interface should not disclose. Successful exploitation does not modify system state, but the disclosed content can be reused to escalate access, forge sessions, or plan supply-chain and firmware-persistence attacks against the platform. See the Dell Security Update DSA-2025-046 for vendor-provided technical scope.

Detection Methods for CVE-2025-26482

Indicators of Compromise

Unexpected authenticated sessions to the iDRAC9 web UI, Redfish API, or racadm interface from non-administrative subnets
Repeated Redfish GET requests against sensitive endpoints (e.g., /redfish/v1/Managers/iDRAC.Embedded.1/) issued by administrative accounts outside normal change windows
iDRAC Lifecycle Log entries showing configuration reads or diagnostic exports not tied to a documented ticket

Detection Strategies

Forward iDRAC9 syslog and Lifecycle Logs to a SIEM and alert on high-privilege authentication events followed by bulk read operations
Correlate BMC access with jump-host activity to identify sessions that bypass the privileged access workflow
Baseline normal Redfish and IPMI traffic per host and flag deviations, particularly requests from workstation subnets

Monitoring Recommendations

Enforce dedicated logging for the out-of-band management VLAN and retain iDRAC audit logs for at least 12 months
Monitor for firmware version drift across the PowerEdge fleet using Dell OpenManage Enterprise or an equivalent inventory tool
Track use of local iDRAC administrator accounts and alert when they are used instead of federated identities

How to Mitigate CVE-2025-26482

Immediate Actions Required

Apply the BIOS and iDRAC9 firmware updates listed in Dell Security Update DSA-2025-046 to every affected PowerEdge, XC Core, and NX system
Rotate iDRAC9 administrative credentials, service account passwords, and any shared secrets stored on affected controllers after patching
Audit iDRAC9 account inventory and remove unused administrator accounts, especially local accounts not tied to central identity

Patch Information

Dell has released remediated BIOS and iDRAC9 firmware versions in advisory DSA-2025-046. Administrators should consult the advisory for the exact fixed firmware version for each PowerEdge model and deploy through Dell OpenManage Enterprise, iDRAC Lifecycle Controller, or Dell Repository Manager. Verify installation by checking the running BIOS and iDRAC firmware revisions against the vendor-listed fixed versions before returning systems to production.

Workarounds

Isolate iDRAC9 interfaces on a dedicated out-of-band management network unreachable from user or server production VLANs
Restrict iDRAC9 administrative access to named jump hosts and enforce multi-factor authentication through Active Directory or LDAP integration
Disable unused management protocols such as IPMI over LAN, SNMPv1/v2c, and the virtual console when not required, and prefer Redfish with TLS 1.2 or higher

bash

# Configuration example: harden iDRAC9 access using racadm
racadm set iDRAC.IPMILan.Enable 0
racadm set iDRAC.SNMP.AgentEnable 0
racadm set iDRAC.WebServer.TLSProtocol TLSv1.2+
racadm set iDRAC.Users.2.Enable 0
racadm set iDRAC.LDAP.Enable 1
racadm set iDRAC.LDAP.CertValidationEnable 1