A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands a…

Overview

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.

This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root.

Affected

• enterprise_nfv_infrastructure_software = 3.3.1
• enterprise_nfv_infrastructure_software = 3.4.1
• enterprise_nfv_infrastructure_software = 3.5.1
• enterprise_nfv_infrastructure_software = 3.5.2
• enterprise_nfv_infrastructure_software = 3.6.1
• enterprise_nfv_infrastructure_software = 3.6.2
• enterprise_nfv_infrastructure_software = 3.6.3
• enterprise_nfv_infrastructure_software = 3.7.1
• enterprise_nfv_infrastructure_software = 3.8.1
• enterprise_nfv_infrastructure_software = 3.9.1
• enterprise_nfv_infrastructure_software = 3.9.2
• enterprise_nfv_infrastructure_software = 3.10.1
• enterprise_nfv_infrastructure_software = 3.10.2
• enterprise_nfv_infrastructure_software = 3.10.3
• enterprise_nfv_infrastructure_software = 3.11.1
• enterprise_nfv_infrastructure_software = 3.11.2
• enterprise_nfv_infrastructure_software = 3.11.3
• enterprise_nfv_infrastructure_software = 3.12.1
• enterprise_nfv_infrastructure_software = 3.12.1a
• enterprise_nfv_infrastructure_software = 3.12.1b
• enterprise_nfv_infrastructure_software = 3.12.2
• enterprise_nfv_infrastructure_software = 3.12.3
• enterprise_nfv_infrastructure_software = 4.1.1
• enterprise_nfv_infrastructure_software = 4.1.2
• enterprise_nfv_infrastructure_software = 4.2.1
• enterprise_nfv_infrastructure_software = 4.2.2
• enterprise_nfv_infrastructure_software = 4.4.1
• enterprise_nfv_infrastructure_software = 4.4.2
• enterprise_nfv_infrastructure_software = 4.4.3
• enterprise_nfv_infrastructure_software = 4.5.1
• enterprise_nfv_infrastructure_software = 4.6.1
• enterprise_nfv_infrastructure_software = 4.6.2
• enterprise_nfv_infrastructure_software = 4.6.2-fc2
• enterprise_nfv_infrastructure_software = 4.6.2-fc3
• enterprise_nfv_infrastructure_software = 4.6.3
• enterprise_nfv_infrastructure_software = 4.6.3-fc4
• enterprise_nfv_infrastructure_software = 4.6.4
• enterprise_nfv_infrastructure_software = 4.6.5-es1
• enterprise_nfv_infrastructure_software = 4.7.1
• enterprise_nfv_infrastructure_software = 4.8.1
• enterprise_nfv_infrastructure_software = 4.8.2
• enterprise_nfv_infrastructure_software = 4.9.1
• enterprise_nfv_infrastructure_software = 4.9.2
• enterprise_nfv_infrastructure_software = 4.9.2-fc5
• enterprise_nfv_infrastructure_software = 4.9.3
• enterprise_nfv_infrastructure_software = 4.9.4
• enterprise_nfv_infrastructure_software = 4.9.4-es8
• enterprise_nfv_infrastructure_software = 4.9.4-es9
• enterprise_nfv_infrastructure_software = 4.9.4-fc3
• enterprise_nfv_infrastructure_software = 4.9.5
• enterprise_nfv_infrastructure_software = 4.9.6
• enterprise_nfv_infrastructure_software = 4.10.1
• enterprise_nfv_infrastructure_software = 4.11.1
• enterprise_nfv_infrastructure_software = 4.12.1
• enterprise_nfv_infrastructure_software = 4.12.2
• enterprise_nfv_infrastructure_software = 4.12.3
• enterprise_nfv_infrastructure_software = 4.12.4
• enterprise_nfv_infrastructure_software = 4.12.5
• enterprise_nfv_infrastructure_software = 4.12.6
• enterprise_nfv_infrastructure_software = 4.13.1
• enterprise_nfv_infrastructure_software = 4.14.1
• enterprise_nfv_infrastructure_software = 4.15.1
• enterprise_nfv_infrastructure_software = 4.15.2
• enterprise_nfv_infrastructure_software = 4.15.3
• enterprise_nfv_infrastructure_software = 4.15.4
• enterprise_nfv_infrastructure_software = 4.16.1
• enterprise_nfv_infrastructure_software = 4.18.1
• enterprise_nfv_infrastructure_software = 4.18.2
• enterprise_nfv_infrastructure_software = 4.18.2a
• unified_computing_system = 3.1(1d)
• unified_computing_system = 3.1(2b)
• unified_computing_system = 3.1(2c)
• unified_computing_system = 3.1(2d)
• unified_computing_system = 3.1(2e)
• unified_computing_system = 3.1(2g)
• unified_computing_system = 3.1(2i)
• unified_computing_system = 3.1(3a)
• unified_computing_system = 3.1(3b)
• unified_computing_system = 3.1(3c)
• unified_computing_system = 3.1(3d)
• unified_computing_system = 3.1(3g)
• unified_computing_system = 3.1(3h)
• unified_computing_system = 3.1(3i)
• unified_computing_system = 3.1(3j)
• unified_computing_system = 3.1(3k)
• unified_computing_system = 4.0(1.240)
• unified_computing_system = 4.0(1a)
• unified_computing_system = 4.0(1b)
• unified_computing_system = 4.0(1c)
• unified_computing_system = 4.0(1d)
• unified_computing_system = 4.0(1e)
• unified_computing_system = 4.0(1g)
• unified_computing_system = 4.0(1h)
• unified_computing_system = 4.0(2c)
• unified_computing_system = 4.0(2d)
• unified_computing_system = 4.0(2f)
• unified_computing_system = 4.0(2g)
• unified_computing_system = 4.0(2h)
• unified_computing_system = 4.0(2i)
• unified_computing_system = 4.0(2k)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.