Dell iDRAC10 Predictable Password Generation

Executive summary #

The iDRAC10 CIAM resetPassword path can generate a predictable local-account password because it uses a time-seeded, non-cryptographic random generator under the shipped configuration. An administrator able to invoke the relevant reset flow may be able to recover the generated password if its generation time can be sufficiently narrowed. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.4, Medium), and is an instance of CWE-338 (Use of Cryptographically Weak PRNG).

Technical details #

The Go ciam-service selects its password generator based on local_accounts_config.password_regex_allowed. When the field is non-nil, resetPassword uses a math/rand-based generator seeded from the current time; the normal cryptographic generator is used only when the field is nil. The boot-time bootstrap_ciam_service.sh configuration sets this field, making the weak branch the normal path. The generated password is then salted, hashed, and stored. Other CIAM secrets continue to use cryptographic randomness.

Attacker value #

An authenticated administrator who can invoke the reset flow and determine its timing may be able to reproduce the random sequence and recover the generated password, potentially gaining access to the affected local account. The feasibility depends on how closely the generation time can be constrained. This weakness applies to the generated password, not the separate CIAM tokens or other secrets.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure