EUVD-2026-53466
GHSA-424c-37gm-gvcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Admin credentials via phishing or credential reuse
-
DeliveryAuthenticate to IMC web management interface
-
ExploitSubmit crafted input containing command delimiters
-
ExecutionBackend fails to sanitize input (CWE-146)
-
PersistInject OS commands execute as privileged process
-
ImpactEscalate privileges to OS root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Expression separator neutralization
|
| Exploitation Conditions | Exploitation requires an authenticated session with Admin-level privileges on the Cisco IMC web-based management interface - as confirmed by the CVSS vector PR:H. An unauthenticated or low-privileged user cannot trigger this vulnerability. The IMC web interface must be reachable over the network from the attacker's position (AV:N), which in well-segmented environments means the attacker must already be on or have access to the out-of-band management network or VLAN. No special non-default configuration is required beyond the presence of Admin credentials; the vulnerability exists in the standard web management functionality. Limiting exploitation: the Admin credential requirement is a meaningful barrier in environments with strong credential hygiene; segmenting IMC management interfaces from general corporate networks prevents network-based access; and Cisco UCS systems that are managed exclusively via UCS Manager Fabric Interconnect (rather than standalone IMC) may have different exposure characteristics - verify deployment mode per the Cisco advisory. |
| Impact | The CVSS 6.5 base score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) accurately captures the prerequisite of Admin credentials, which meaningfully limits the attacker population compared to unauthenticated or low-privilege vectors. However, Cisco explicitly elevated the Security Impact Rating to High, citing that root-level OS access - the post-exploitation outcome - enables capabilities well beyond what the CVSS score conveys, including persistent backdoor installation, exfiltration of out-of-band management credentials, and lateral movement to managed servers. The A:N metric in the official CVSS vector appears conservative given that root OS access on a management controller can trivially affect system availability; this analysis assesses A:H as more reflective of actual impact. No EPSS data, POC, or CISA KEV listing was provided, so exploitation probability cannot be quantified. The practical risk is tempered by the Admin-privilege requirement - an attacker already holding Admin credentials to the IMC has substantial existing access - but the escalation to true OS root bypasses any application-layer access controls Cisco may impose on the Admin role. |
| Exploit ScenarioDerived | An attacker who has obtained Cisco IMC Admin credentials - whether through credential stuffing, phishing, or lateral movement within an enterprise management network - authenticates to the web-based management interface of an affected UCS server. The attacker submits a crafted form value or API parameter containing shell command delimiters (e.g., semicolons, backticks, or pipe characters) that the IMC backend passes unsanitized to an OS-level command. The injected commands execute as a privileged service account and subsequently escalate to root, giving the attacker full OS control over the management controller - including the ability to modify firmware, install persistent backdoors, or pivot to managed server infrastructure via IPMI/redfish interfaces. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU for fixed firmware versions - the advisory (cisco-sa-cimc-arg-inject-upSHdMfU) is the authoritative source for patched releases, as no specific fixed version numbers were included in the intelligence data available for this analysis. As an interim compensating control, restrict network access to the Cisco IMC web management interface to trusted administrator workstations and dedicated out-of-band management networks using firewall ACLs or VLAN segmentation, preventing opportunistic network access to port 443/80 of the IMC. Apply the principle of least privilege by auditing which accounts hold Admin-level IMC credentials and revoking any that are unnecessary - reducing the Admin population directly limits the exploitable attack surface. Enable IMC audit logging and alert on unusual command patterns or configuration changes. Note that restricting network access does not eliminate risk if attackers have already obtained Admin credentials through other means; patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco IMC is the out-of-band management controller embedded in Cisco Unified Computing System (UCS) servers, providing a web-based interface for hardware lifecycle management, BIOS configuration, and remote console access. The vulnerability is rooted in CWE-146 (Improper Neutralization of Expression/Command Delimiters), a form of argument/command injection where user-supplied input passed to a backend OS-level command interpreter is not properly sanitized or quoted. When an Admin submits crafted input through the web UI, the application constructs an OS command using that input without sufficient delimiter escaping, allowing injected shell metacharacters or argument separators to alter the executed command. Affected products per CPE data are cpe:2.3:a:cisco:cisco_unified_computing_system_(standalone) and cpe:2.3:a:cisco:cisco_unified_computing_system_e-series_software_(ucse), spanning a wide range of firmware versions across both product lines (3.1.x through 6.0.x for Standalone; 3.1.x through 4.15.x for UCSE).
Know when Cisco Unified Computing System Standalone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Root OS access on a management controller enables availability disruption; A:H is more accurate than the official A:N; all other metrics align with provided vector.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacke
Command injection in Cisco Integrated Management Controller (IMC) web interface allows authenticated attackers with read
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Cisco IMC web-based management interface allows authenticated administrators to execute arbitrary code as root through i
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB