Thank you for that time to look into this. It is determined no action is needed. It can be understood from [URL] that iDRAC uses Apache. So that is widely available. We do specifically remove the version number from the Server headers.  
Security scans of our systems have vulnerability findings for our iDRAC9's - Information Disclosure, HTTP headers: The HTTP headers sent by the remote web server disclose information that can aid an attacker. This information discloses the server’s name, framework name and their versions which serves no purpose for users, and there is no need to disclose this. Sites/Servers should not disclose any information not needed for the site to be available and working. Header on tcp port 80 http = Apache (302-[URL] ) Header on tcp port 443 https = Apache ( 302-[URL] ) How do we remove the Web Server (Apache) from the headers?
iDRAC9 Information Disclosure vulnerability