CVE-2022-24422

What it actually does

Dell iDRAC9 firmware versions 5.00.00.00 and later, before 5.10.10.00, contain an improper authentication flaw that can allow a remote unauthenticated attacker to access the iDRAC VNC Console. Because iDRAC provides out-of-band server management, successful exploitation can expose an interactive server console with confidentiality, integrity, and availability impact: an attacker may view console output, interact with the system as if physically present, interrupt boot processes, modify firmware/BIOS or boot settings where available, mount virtual media, power-cycle systems, or support further host compromise depending on configuration and console state.

Why it matters to the business

Compromise of iDRAC can undermine trust in the physical server layer, potentially allowing attackers to disrupt critical workloads, access sensitive data displayed on consoles, alter server configuration, or enable persistence outside the operating system. The CVSS score is critical and EPSS is elevated, so internet-exposed or broadly reachable iDRAC management interfaces should be treated as high-priority remediation targets even though the vulnerability is not currently listed in CISA KEV and no public exploit maturity was provided.

How an attack unfolds

An attacker first identifies exposed Dell iDRAC9 management interfaces and determines whether the firmware is in the affected range. If VNC Console functionality is enabled and reachable, the attacker attempts to initiate a VNC Console connection without completing proper authentication. On vulnerable firmware, the iDRAC may permit access to the remote console, giving the attacker direct out-of-band interaction with the managed server. From there, the attacker can observe console activity, interact with pre-login prompts, access boot menus, change server power state, attach virtual media if permitted by configuration, or use the console position to support operating-system compromise. Exploitation is especially damaging when iDRAC is reachable from untrusted networks or when management interfaces share routing with user or server networks.

How to fix it

Upgrade Dell iDRAC9 firmware to version 5.10.10.00 or later. If immediate upgrade is not possible, disable VNC Console access, restrict iDRAC management interfaces to dedicated management networks, block access from the internet and untrusted networks, enforce VPN or bastion-host access, and limit access with firewall allowlists. Review iDRAC user accounts, role assignments, virtual console permissions, virtual media settings, and power-control permissions. Ensure iDRAC logging is enabled and forwarded to a central log platform before and after remediation.

How to confirm the fix worked

Confirm each Dell iDRAC9 device is running firmware 5.10.10.00 or later by checking the iDRAC web interface, RACADM, Redfish API, or asset inventory. Validate that VNC Console is disabled unless explicitly required, and verify that VNC and iDRAC management ports are not reachable from untrusted networks. Run authenticated configuration checks where possible and perform controlled network scans to confirm that iDRAC web, Redfish, SSH, and VNC services are restricted to approved management sources only. Review firewall rules and exposure management results for any remaining externally reachable iDRAC endpoints.

Typical attack path

1. Scan for Dell iDRAC9 management interfaces exposed over the network.
2. Fingerprint iDRAC version and identify systems running 5.00.00.00 through versions prior to 5.10.10.00.
3. Check whether VNC Console or virtual console access is enabled and reachable, commonly over the configured VNC service port.
4. Initiate a VNC Console session while bypassing expected authentication controls.
5. Interact with the server console to view sensitive information, change boot or management settings, mount media, power-cycle the host, or advance toward OS-level compromise.
6. Remove evidence where possible or maintain access through out-of-band management configuration changes.

How to detect it

Investigate whether iDRAC VNC Console access occurred from unauthorized sources. Useful telemetry includes iDRAC Lifecycle Log, iDRAC audit/system event logs, remote syslog exports, RACADM/Redfish audit records, firewall logs, VPN or bastion logs, NetFlow, packet captures, and SIEM events for management-network access. Look for VNC/RFB handshakes to iDRAC addresses, connections to TCP 5900 or any configured VNC Console port, virtual console session start and end events, power-control actions, virtual media mount events, BIOS or boot-order changes, and management logins or configuration changes near the same time. Because exploitation may bypass normal authentication, absence of a matching successful login does not rule out abuse; correlate console session activity with approved administrator activity and source IP allowlists. Pay special attention to sessions from internet addresses, user subnets, VPN pools not used for server administration, vulnerability scanners followed by VNC connections, and any console activity outside maintenance windows.

• TCP/5900 connections to iDRAC management interfaces
• RFB 003.
• VNC Console
• Virtual Console
• Console Redirection
• virtual console session
• Virtual Console session started
• Virtual Console session ended
• VNC Server
• Virtual Media
• virtual media attached
• virtual media detached
• racadm getversion
• /redfish/v1/Managers/iDRAC.Embedded.1
• /redfish/v1/Systems/System.Embedded.1
• /redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia
• PowerCycle
• ForceRestart
• GracefulRestart

What your security team should do

• Prioritize remediation of any internet-exposed or broadly reachable Dell iDRAC9 systems running firmware before 5.10.10.00.
• Upgrade iDRAC9 firmware to 5.10.10.00 or later; where upgrades are delayed, immediately disable VNC Console and restrict management access by network controls.
• Inventory all Dell iDRAC9 devices, including systems managed outside standard endpoint tooling, and record firmware version, VNC status, and exposure path.
• Search historical logs and network telemetry for unexpected VNC or virtual console activity to iDRAC interfaces, especially from non-management source IPs.
• Place iDRAC management interfaces on isolated management networks with strict allowlists, centralized logging, and administrative access through controlled jump hosts or VPN.
• Review iDRAC accounts and privileges, rotate credentials where suspicious access is observed, and verify that virtual media and power-control permissions are limited.
• Monitor future Dell advisories and firmware releases for related iDRAC authentication, console, and out-of-band management fixes.