Dell iDRAC Shared TLS Key

Executive summary #

The same private TLS client key is shipped in firmware for iDRAC7, iDRAC8, iDRAC9, and iDRAC10, allowing anyone who extracts it to possess the client identity used for provisioning enrollment. Depending on the deployment, that may enable impersonation to a provisioning server or interception of enrollment traffic. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (3.1, Low), and is an instance of CWE-321 (Use of Hard-coded Cryptographic Key).

Technical details #

The cleartext usr/share/discovery/client.pem artifact contains a client certificate and RSA private key used for outbound mutual-TLS with Dell auto-discovery/provisioning services. The key is byte-identical across the confirmed iDRAC7 2.65, iDRAC8 2.83, iDRAC9 7.20.10.50, and iDRAC10 1.30.10.50 firmware. It is not used to authenticate clients to the iDRAC web interface; the HTTPS server does not request client certificates.

Attacker value #

An attacker with the extracted key may impersonate an iDRAC to a provisioning or OpenManage Enterprise server that accepts the shared client identity. An on-path attacker may also use it to impersonate the client during enrollment. Both impacts depend on access to the enrollment path and on the provisioning server's acceptance and handling of that identity. iDRAC9 7.00.00.184 is expected to be affected but was not extracted for confirmation.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure