TI-2021-04597 Aliases CVE-2021-21505 GHSA-3j78-gc32-cr37

Credentials management flaw in Dell EMC Integrated System for Microsoft Azure Stack Hub

MEDIUM 47CWE-255Published 2021-05-06 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacker, with the knowledge of the default credentials, could potentially exploit this to log in to the system to gain root privileges.

Why it matters now

EPSS 0.02387 84th percentileScored 2026-11-07

Fix Fixed Dell EMC Integrated System for Microsoft Azure Stack Hub (Dell): 2102

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Dell EMC Integrated System for Microsoft Azure Stack Hub	before 2102	2102	Patch available	CNA

Dell EMC Integrated System for Microsoft Azure Stack Hub VendorDell Affected before 2102 Fixed in 2102 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:dell:emc_integrated_system_for_microsoft_azure_stack_hub_firmware::::::::	1906 – 2011	Vulnerable	Dell
cpe:2.3:h:dell:emc_integrated_system_for_microsoft_azure_stack_hub:-:::::::*	not specified by NVD	Running on	Dell

cpe:2.3:o:dell:emc_integrated_system_for_microsoft_azure_stack_hub_firmware:*:*:*:*:*:*:*:* Versions 1906 – 2011 Vulnerable ·Dell
cpe:2.3:h:dell:emc_integrated_system_for_microsoft_azure_stack_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

Fix · CNA Dell EMC Integrated System for Microsoft Azure Stack Hub (Dell) Fixed in 2102

Timeline

2026-10-02 Threatist record created from CVE-2021-21505
2026-10-03 Alias added: GHSA-3j78-gc32-cr37

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000186008/dsa-2021-020-dell-emc-integrated-system-for-microsoft-azure-stack-hub-security-update-for-an-idrac-undocumented-account-vulnerability

TI-2021-14668 Improper privilege management in Dell EMC Integrated System for Microsoft Azure Stack Hub CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences