CVE-2013-3589: Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRA...

Security readout for executives and security teams

This CVE is an XSS flaw in the Dell iDRAC administrative web login page. A remote attacker could inject script or HTML through the ErrorMsg parameter on affected firmware. Because iDRAC manages server hardware, exposed management interfaces should be treated as operationally sensitive even though the bundle does not show active exploitation. Exposure is likely limited to organizations still running Dell iDRAC6 monolithic firmware below 1.96 or iDRAC7 firmware below 1.46.45, especially where the administrative web interface is reachable from user networks or the internet. Handle this as a targeted hygiene item for server management infrastructure. It is not supported as actively exploited in the bundle, but vulnerable iDRAC interfaces can sit close to critical hardware administration and should not remain exposed or outdated. Mitigation focus: Upgrade iDRAC6 monolithic firmware to 1.96 or later where applicable.; Upgrade iDRAC7 firmware to 1.46.45 or later where applicable.; Restrict iDRAC web access to trusted management networks..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.