EUVD-2026-53466
GHSA-424c-37gm-gvcf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Root OS access on a management controller enables availability disruption; A:H is more accurate than the official A:N; all other metrics align with provided vector.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
AnalysisAI
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
Cisco IMC is the out-of-band management controller embedded in Cisco Unified Computing System (UCS) servers, providing a web-based interface for hardware lifecycle management, BIOS configuration, and remote console access. The vulnerability is rooted in CWE-146 (Improper Neutralization of Expression/Command Delimiters), a form of argument/command injection where user-supplied input passed to a backend OS-level command interpreter is not properly sanitized or quoted. When an Admin submits crafted input through the web UI, the application constructs an OS command using that input without sufficient delimiter escaping, allowing injected shell metacharacters or argument separators to alter the executed command. Affected products per CPE data are cpe:2.3:a:cisco:cisco_unified_computing_system_(standalone) and cpe:2.3:a:cisco:cisco_unified_computing_system_e-series_software_(ucse), spanning a wide range of firmware versions across both product lines (3.1.x through 6.0.x for Standalone; 3.1.x through 4.15.x for UCSE).
RemediationAI
Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU for fixed firmware versions - the advisory (cisco-sa-cimc-arg-inject-upSHdMfU) is the authoritative source for patched releases, as no specific fixed version numbers were included in the intelligence data available for this analysis. As an interim compensating control, restrict network access to the Cisco IMC web management interface to trusted administrator workstations and dedicated out-of-band management networks using firewall ACLs or VLAN segmentation, preventing opportunistic network access to port 443/80 of the IMC. Apply the principle of least privilege by auditing which accounts hold Admin-level IMC credentials and revoking any that are unnecessary - reducing the Admin population directly limits the exploitable attack surface. Enable IMC audit logging and alert on unusual command patterns or configuration changes. Note that restricting network access does not eliminate risk if attackers have already obtained Admin credentials through other means; patching remains the definitive fix.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacke
Command injection in Cisco Integrated Management Controller (IMC) web interface allows authenticated attackers with read
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Cisco IMC web-based management interface allows authenticated administrators to execute arbitrary code as root through i
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today