EUVD-2026-17953
GHSA-6v24-9xph-9cp8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
AnalysisAI
Cisco IMC web-based management interface allows authenticated administrators to execute arbitrary code as root through improper input validation in HTTP requests. The vulnerability affects Cisco Unified Computing System (standalone) and requires admin-level credentials and network access; successful exploitation grants attacker root-level code execution on the underlying operating system. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
This vulnerability stems from a buffer overflow (CWE-787: Out-of-bounds Write) in the web-based management interface of Cisco IMC (Integrated Management Controller), which is the management component for Cisco Unified Computing System (UCS) standalone servers. The root cause is improper validation of user-supplied input sent via HTTP requests to the management interface, allowing an attacker with admin credentials to craft malicious HTTP payloads that trigger memory corruption. IMC operates as a privileged management plane running with root-level access to the underlying operating system; exploitation allows attackers to break out of the management interface context and achieve arbitrary code execution in the root security context.
RemediationAI
Consult the official Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt for patched IMC firmware versions specific to your Unified Computing System model and generation. Apply the recommended firmware update immediately upon release. Interim mitigations should include restricting network access to the IMC web-based management interface via firewall rules to limit exposure to trusted administrative networks only, implementing strong access controls and multi-factor authentication for admin-level IMC accounts, regularly auditing admin account activity and credential usage, and monitoring IMC logs for suspicious HTTP requests or command execution attempts. Do not disable the management interface entirely as it is required for system administration.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacke
Command injection in Cisco Integrated Management Controller (IMC) web interface allows authenticated attackers with read
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-le
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today