CVE-2024-20356
published 2024-04-24CVE-2024-20356: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with…
PriorityP269high8.7CVSS 3.1
AVNACLPRHUINSCCHIHAN
EPSS
32.70%
98.1th percentile
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root.
Affected
156 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is the web-based management interface of Cisco IMC; monitor for crafted/anomalous POST requests to the IMC web UI from authenticated Administrator-level sessions that contain shell metacharacters or injection payloads ↗
- →Privilege escalation to root is the success indicator; alert on unexpected root-level process spawning from the Cisco IMC web service process ↗
- →Root cause is insufficient user input validation (CWE-78 OS Command Injection); inspect IMC web interface input fields for unsanitized shell metacharacters ↗
- ·Exploitation requires the attacker to already hold Administrator-level privileges on the Cisco IMC web interface; detections should focus on authenticated admin sessions exhibiting injection behavior rather than unauthenticated access ↗
- ·No workarounds exist; patching is the only mitigation. Track Cisco Bug IDs CSCwi42996, CSCwi43001, and CSCwi43005 for affected product versions and fix availability ↗
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
vendor_cisco8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
vendor_cisco·2024-04-17·CVSS 8.7
CVE-2024-20356 [HIGH] CWE-78 Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root.
This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Th
Cisco
Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20356 Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
CVE-2024-20356: Cisco Integrated Management Controller Web-Based Management Interface Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator -level privileges to perform command injection attacks on an affected system and elevate their privileges to root . This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root . Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-78, CWE-78
B
GHSA
GHSA-m2xm-r93v-mjrm: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker wi
ghsa_unreviewed·2024-04-24
CVE-2024-20356 [HIGH] CWE-78 GHSA-m2xm-r93v-mjrm: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker wi
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-24
Published