EUVD-2026-17953
GHSA-6v24-9xph-9cp8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
AnalysisAI
Cisco IMC web-based management interface allows authenticated administrators to execute arbitrary code as root through improper input validation in HTTP requests. The vulnerability affects Cisco Unified Computing System (standalone) and requires admin-level credentials and network access; successful exploitation grants attacker root-level code execution on the underlying operating system. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
This vulnerability stems from a buffer overflow (CWE-787: Out-of-bounds Write) in the web-based management interface of Cisco IMC (Integrated Management Controller), which is the management component for Cisco Unified Computing System (UCS) standalone servers. The root cause is improper validation of user-supplied input sent via HTTP requests to the management interface, allowing an attacker with admin credentials to craft malicious HTTP payloads that trigger memory corruption. IMC operates as a privileged management plane running with root-level access to the underlying operating system; exploitation allows attackers to break out of the management interface context and achieve arbitrary code execution in the root security context.
RemediationAI
Consult the official Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt for patched IMC firmware versions specific to your Unified Computing System model and generation. Apply the recommended firmware update immediately upon release. Interim mitigations should include restricting network access to the IMC web-based management interface via firewall rules to limit exposure to trusted administrative networks only, implementing strong access controls and multi-factor authentication for admin-level IMC accounts, regularly auditing admin account activity and credential usage, and monitoring IMC logs for suspicious HTTP requests or command execution attempts. Do not disable the management interface entirely as it is required for system administration.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today