EUVD-2025-16890
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges. This vulnerability is due to insufficient restrictions on access to internal services. An attacker with a valid user account could exploit this vulnerability by using crafted syntax when connecting to the Cisco IMC of an affected device through SSH. A successful exploit could allow the attacker to access internal services with elevated privileges, which may allow unauthorized modifications to the system, including the possibility of creating new administrator accounts on the affected device.
Analysis
Critical authentication bypass vulnerability in Cisco Integrated Management Controller (IMC) across multiple UCS server platforms that allows authenticated remote attackers to escalate privileges and access internal services with elevated permissions via crafted SSH syntax. The vulnerability affects UCS B-Series, C-Series, S-Series, and X-Series servers, enabling attackers to create administrator accounts and modify system configurations. With a CVSS score of 8.8 and low attack complexity requiring only valid credentials, this vulnerability poses significant risk to data center infrastructure and should be prioritized for patching.
Technical Context
This vulnerability resides in the SSH connection handling mechanism of Cisco IMC, which is the baseboard management controller (BMC) firmware responsible for out-of-band server management. The root cause is classified as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), indicating that the SSH service fails to properly validate or restrict access to internal management services based on user roles and privileges. The IMC exposes privileged internal services through SSH that should be access-controlled, but insufficient validation of SSH connection parameters and user context allows authenticated users to bypass these restrictions through crafted syntax. This affects CPE entries for Cisco UCS platforms: cisco:ucs_b-series, cisco:ucs_c-series, cisco:ucs_s-series, and cisco:ucs_x-series across multiple firmware versions, where the BMC/IMC firmware is the vulnerable component.
Affected Products
Cisco UCS Integrated Management Controller firmware affecting: (1) UCS B-Series Servers (all current generations); (2) UCS C-Series Servers (C220, C240, C480, etc.); (3) UCS S-Series Servers; (4) UCS X-Series Servers. The vulnerability exists in IMC firmware versions prior to patched releases. Affected CPE: cpe:2.3:o:cisco:ucs_b-series_server_firmware:*, cpe:2.3:o:cisco:ucs_c-series_server_firmware:*, cpe:2.3:o:cisco:ucs_s-series_server_firmware:*, cpe:2.3:o:cisco:ucs_x-series_server_firmware:*. Specific version boundaries and patches should be obtained from Cisco Security Advisory for CVE-2025-20261. Organizations with IMC/CIMC remote access enabled (common in managed service provider and hybrid cloud scenarios) face highest risk.
Remediation
Immediate actions: (1) Apply Cisco-released firmware patch to affected IMC/CIMC versions - consult Cisco Security Advisory CVE-2025-20261 for specific patch versions by platform; (2) If patching cannot be immediately deployed, implement network-level controls: restrict SSH access to IMC to trusted administrative networks only, disable remote IMC access if not required, implement host-based firewall rules limiting IMC connectivity; (3) Audit IMC user accounts for unauthorized administrator accounts created post-compromise; (4) Review IMC audit logs for suspicious SSH connection attempts with anomalous syntax patterns; (5) Enforce strong password policies and multi-factor authentication on IMC accounts if supported by firmware version; (6) Consider disabling IMC remote access entirely and using only console/local access during remediation window. Patch availability expected from Cisco within standard advisory timeline - monitor Cisco Security Center for release notification.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today