Cisco IMC EUVD-2026-53451

Exploitation requires a valid Cisco IMC account with at minimum low-privilege access (e.g., read-only or operator role) to the web-based management interface. The CVSS vector PR:L confirms authenticated access is mandatory - unauthenticated exploitation is not possible. The interface must be reachable over the network (AV:N), which is true for any IMC with remote management enabled and network connectivity, including management VLANs. No user interaction by a second party is required (UI:N). Exploitation is limited by the authentication barrier: attackers without any valid IMC credential cannot exploit this flaw. The attack is further limited to the Cisco UCS Standalone deployment model (not UCS managed by Fabric Interconnect), and only specific 4.3.x and 6.0.x firmware builds enumerated in EUVD-2026-53451 are confirmed affected.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile: network-reachable, low complexity, requires only low-privileged authentication, and yields full root-level OS access. The PR:L requirement is a meaningful barrier - an attacker must first obtain any valid IMC credential - but IMC accounts at low privilege tiers are common in shared or multi-team environments. No EPSS data was provided in the input and the vulnerability is not currently listed in the CISA KEV catalog, so widespread exploitation is not confirmed. However, the IMC management interface is frequently accessible from internal management VLANs, and privilege escalation to root on a server's out-of-band controller represents a severe impact: an attacker with root on IMC can potentially manipulate hardware configuration, BIOS settings, or interfere with the hosted OS lifecycle. The tag 'Information Disclosure' in the source metadata appears inconsistent with the C:H/I:H/A:H impact vector and the command execution primitive described - this should be verified against the full Cisco advisory, as the disclosure tag may be a metadata error or secondary artifact.

An attacker who has obtained or brute-forced low-privileged Cisco IMC credentials - for example, a read-only operator account shared among a data center team - logs into the IMC web interface over the network and submits a crafted form field or API parameter containing shell delimiters or argument injection sequences. The IMC backend passes the unsanitized input to an OS-level command, executing attacker-controlled arguments as root, giving the attacker full control of the management controller and its attached hardware configuration. No public exploit code has been identified at time of analysis, but the low attack complexity suggests this class of vulnerability is straightforward to reproduce from the description alone.