Description
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Unified Computing System (Standalone) | 4.0(2g), 3.1(2i), 3.1(1d), 4.0(4i), 4.1(1c), 4.0(2c), 4.0(1e), 4.0(2h), 4.0(4h), 4.0(1h), 4.0(2l), 3.1(3g), 4.0(1.240), 4.0(2f), 4.0(1g), 4.0(2i), 3.1(3i), 4.0(4d), 4.1(1d), 3.1(3c), 4.0(4k), 3.1(2d), 3.1(3a), 3.1(3j), 4.0(2d), 4.1(1f), 4.0(4j), 4.0(2m), 4.0(2k), 4.0(1c), 4.0(4f), 4.0(4c), 3.1(3d),… | — |
| Cisco | Cisco Unified Computing System E-Series Software (UCSE) | 3.2.7, 3.2.6, 3.2.4, 3.2.10, 3.2.2, 3.2.3, 2.4.0, 3.2.1, 3.2.11.1, 3.2.8, 3.1.1, 3.0.2, 2.1.0, 2.2.2, 3.1.2, 3.0.1, 2.3.2, 2.3.5, 2.2.1, 3.1.4, 2.4.1, 2.3.1, 3.1.3, 2.3.3, 2.4.2, 3.1.5, 3.1.0, 2.0.0, 3.2.11.3, 3.2.11.5, 3.2.12.2, 3.2.13.6, 3.2.14, 4.11.1, 3.2.15, 4.12.1, 3.2.15.3, 4.12.2, 3.2.16.1,… | — |
Advisories 2
- NCSC-2026-0106 Kwetsbaarheden verholpen in Cisco Integrated Management Controller NCSC-NL (Netherlands) · Apr 3, 2026
- WID-SEC-2026-0953 Cisco Integrated Management Controller: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 1, 2026