EUVD-2025-16890Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges.
This vulnerability is due to insufficient restrictions on access to internal services. An attacker with a valid user account could exploit this vulnerability by using crafted syntax when connecting to the Cisco IMC of an affected device through SSH. A successful exploit could allow the attacker to access internal services with elevated privileges, which may allow unauthorized modifications to the system, including the possibility of creating new administrator accounts on the affected device.
AnalysisAI
Critical authentication bypass vulnerability in Cisco Integrated Management Controller (IMC) across multiple UCS server platforms that allows authenticated remote attackers to escalate privileges and access internal services with elevated permissions via crafted SSH syntax. The vulnerability affects UCS B-Series, C-Series, S-Series, and X-Series servers, enabling attackers to create administrator accounts and modify system configurations. With a CVSS score of 8.8 and low attack complexity requiring only valid credentials, this vulnerability poses significant risk to data center infrastructure and should be prioritized for patching.
Technical ContextAI
This vulnerability resides in the SSH connection handling mechanism of Cisco IMC, which is the baseboard management controller (BMC) firmware responsible for out-of-band server management. The root cause is classified as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), indicating that the SSH service fails to properly validate or restrict access to internal management services based on user roles and privileges. The IMC exposes privileged internal services through SSH that should be access-controlled, but insufficient validation of SSH connection parameters and user context allows authenticated users to bypass these restrictions through crafted syntax. This affects CPE entries for Cisco UCS platforms: cisco:ucs_b-series, cisco:ucs_c-series, cisco:ucs_s-series, and cisco:ucs_x-series across multiple firmware versions, where the BMC/IMC firmware is the vulnerable component.
RemediationAI
Immediate actions: (1) Apply Cisco-released firmware patch to affected IMC/CIMC versions - consult Cisco Security Advisory CVE-2025-20261 for specific patch versions by platform; (2) If patching cannot be immediately deployed, implement network-level controls: restrict SSH access to IMC to trusted administrative networks only, disable remote IMC access if not required, implement host-based firewall rules limiting IMC connectivity; (3) Audit IMC user accounts for unauthorized administrator accounts created post-compromise; (4) Review IMC audit logs for suspicious SSH connection attempts with anomalous syntax patterns; (5) Enforce strong password policies and multi-factor authentication on IMC accounts if supported by firmware version; (6) Consider disabling IMC remote access entirely and using only console/local access during remediation window. Patch availability expected from Cisco within standard advisory timeline - monitor Cisco Security Center for release notification.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today