Products
| Product | |
| 1 | iDRAC10 |
CVE
CVE-2026-65185, CVE-2026-65186, CVE-2026-65187, CVE-2026-65188, CVE-2026-65189, CVE-2026-65190, CVE-2026-65191, CVE-2026-65192, CVE-2026-65193, CVE-2026-65194, CVE-2026-65195, CVE-2026-65196Executive summary #
On iDRAC10, setting IPMI over LAN to Disabled does not disable its dual-stack listener: IPMI-over-LAN remains reachable over IPv6. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (3.7, Low), and is an instance of CWE-693 (Protection Mechanism Failure).
Technical details #
The socket-activated fullfw.socket binds UDP port 623 for both IPv6 and IPv4-mapped traffic. The disable script leaves the socket active and installs only an IPv4 OUTPUT firewall rule; it does not add a corresponding IPv6 rule. Consequently, IPv6 datagrams can still reach the IPMI-over-LAN service and receive replies while the setting is disabled.
Attacker value #
An attacker with IPv6 network reachability to the BMC can still interact with the IPMI-over-LAN service despite the operator's disablement setting. The exposure leaves pre-authentication RMCP+ negotiation reachable; valid credentials or a separate IPMI credential attack are still required for authenticated actions.
Credit #
This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.
Timeline #
- 2026-07-16 (Thu): Initial findings discovered and documented
- 2026-07-21 (Tue): CVE-2026-65186 reserved
- 2026-08-27 (Thu): Vendor notified
- 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
- 2026-10-26 (Mon): This public disclosure
