Dell iDRAC Service Module < 6.0.3.0 Multiple Vulnerabilities (DSA-2025-311)

high Nessus Plugin ID 257438

Synopsis

The remote Windows host has a peripheral control application installed that is missing a security update.

Description

Dell iDRAC Service Module version 6.0.3.0 and prior, contains multiple vulnerabilities as referenced in the DSA-2025-311 advisory.

- Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. (CVE-2025-38742)

- Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges. (CVE-2025-38743)

Note that Nessus has not tested for theseis issues but has instead relied only on the application's self-reported version number.

Solution

Update Dell iDRAC Service Module to version 6.0.3.0 or later.

Plugin Details

Severity: High

ID: 257438

File Name: dell_ism_dsa-2025-311.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 8/27/2025

Updated: 8/27/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-38743

CVSS v3

Risk Factor: High

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:dell:idrac_service_module

Required KB Items: installed_sw/iDRAC Service Module, SMB/Registry/Enumerated

Patch Publication Date: 8/21/2024

Vulnerability Publication Date: 8/21/2024

Reference Information

CVE: CVE-2025-38742, CVE-2025-38743

Detections

Analytics