EUVD-2026-17950Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root.
AnalysisAI
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level privileges to execute arbitrary commands as root. The vulnerability stems from improper input validation in the web interface, enabling attackers to inject crafted commands that execute on the underlying operating system with elevated privileges. While the CVSS score is 6.5 (Medium), Cisco assigned a High Security Impact Rating due to the root-level code execution capability and potential for post-compromise lateral movement or system takeover.
Technical ContextAI
Cisco Integrated Management Controller (IMC) is the out-of-band management interface for Cisco UCS (Unified Computing System) servers and Enterprise NFV Infrastructure. The vulnerability exploits CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating insufficient sanitization of user input before passing it to operating system command execution functions. The affected systems include Cisco UCS Standalone servers, UCS E-Series (UCSE) software, and Enterprise NFV Infrastructure platforms. The web-based management interface accepts administrative input that, when not properly validated, allows shell metacharacters or command separators to be interpreted as executable commands rather than literal strings, leading to arbitrary command injection at the root privilege level.
RemediationAI
Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt for the exact patched versions applicable to your UCS product line and IMC firmware version. Primary remediation is to upgrade IMC firmware to the patched release specified for your Cisco UCS Standalone, UCSE, or Enterprise NFV Infrastructure system. As an interim measure, restrict administrative access to the IMC web-based management interface to trusted networks only using firewall rules or network segmentation, disable unused management protocols, and audit administrative activity logs for suspicious command submissions. Ensure that only necessary administrators have IMC admin-level credentials and implement credential rotation policies.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today