Dell EMC iDRAC - RCE (CVE-2018-1207)
116Exploiting IPs reported
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
CrowdSec analysis
CVE-2018-1207 is a critical CGI injection vulnerability in Dell EMC iDRAC7 and iDRAC8 versions prior to 2.52.52.52, allowing remote unauthenticated attackers to execute arbitrary code on affected systems. This flaw could be exploited to gain full control over the device, leading to potential data breaches, system manipulation, or service disruption.
CrowdSec has been tracking this vulnerability and its exploits since 25th of September 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2018-1207 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2018-1207 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers exploit this vulnerability by sending crafted requests to /cgi-bin/login with the LD_DEBUG parameter, enabling remote code injection on Dell iDRAC7/8 devices.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.