A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validatio…

Overview

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.

Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.

Affected

• unified_computing_system = 3.1(1d)
• unified_computing_system = 3.1(2b)
• unified_computing_system = 3.1(2c)
• unified_computing_system = 3.1(2d)
• unified_computing_system = 3.1(2e)
• unified_computing_system = 3.1(2g)
• unified_computing_system = 3.1(2i)
• unified_computing_system = 3.1(3a)
• unified_computing_system = 3.1(3b)
• unified_computing_system = 3.1(3c)
• unified_computing_system = 3.1(3d)
• unified_computing_system = 3.1(3g)
• unified_computing_system = 3.1(3h)
• unified_computing_system = 3.1(3i)
• unified_computing_system = 3.1(3j)
• unified_computing_system = 3.1(3k)
• unified_computing_system = 4.0(1.240)
• unified_computing_system = 4.0(1a)
• unified_computing_system = 4.0(1b)
• unified_computing_system = 4.0(1c)
• unified_computing_system = 4.0(1d)
• unified_computing_system = 4.0(1e)
• unified_computing_system = 4.0(1g)
• unified_computing_system = 4.0(1h)
• unified_computing_system = 4.0(2c)
• unified_computing_system = 4.0(2d)
• unified_computing_system = 4.0(2f)
• unified_computing_system = 4.0(2g)
• unified_computing_system = 4.0(2h)
• unified_computing_system = 4.0(2i)
• unified_computing_system = 4.0(2l)
• unified_computing_system = 4.0(2n)
• unified_computing_system = 4.0(2o)
• unified_computing_system = 4.0(2p)
• unified_computing_system = 4.0(2q)
• unified_computing_system = 4.0(2r)
• unified_computing_system = 4.0(4b)
• unified_computing_system = 4.0(4c)
• unified_computing_system = 4.0(4d)
• unified_computing_system = 4.0(4e)
• unified_computing_system = 4.0(4f)
• unified_computing_system = 4.0(4h)
• unified_computing_system = 4.0(4i)
• unified_computing_system = 4.0(4k)
• unified_computing_system = 4.0(4l)
• unified_computing_system = 4.0(4m)
• unified_computing_system = 4.0(4n)
• unified_computing_system = 4.1(1c)
• unified_computing_system = 4.1(1d)
• unified_computing_system = 4.1(1f)
• unified_computing_system = 4.1(1g)
• unified_computing_system = 4.1(1h)
• unified_computing_system = 4.1(2a)
• unified_computing_system = 4.1(2b)
• unified_computing_system = 4.1(2d)
• unified_computing_system = 4.1(2e)
• unified_computing_system = 4.1(2f)
• unified_computing_system = 4.1(2g)
• unified_computing_system = 4.1(2h)
• unified_computing_system = 4.1(2j)
• unified_computing_system = 4.1(2k)
• unified_computing_system = 4.1(2l)
• unified_computing_system = 4.1(2m)
• unified_computing_system = 4.1(3b)
• unified_computing_system = 4.1(3c)
• unified_computing_system = 4.1(3d)
• unified_computing_system = 4.1(3f)
• unified_computing_system = 4.1(3h)
• unified_computing_system = 4.1(3i)
• unified_computing_system = 4.1(3l)
• unified_computing_system = 4.1(3m)
• unified_computing_system = 4.1(3n)
• unified_computing_system = 4.2(1a)
• unified_computing_system = 4.2(1b)
• unified_computing_system = 4.2(1c)
• unified_computing_system = 4.2(1e)
• unified_computing_system = 4.2(1f)
• unified_computing_system = 4.2(1g)
• unified_computing_system = 4.2(1i)
• unified_computing_system = 4.2(1j)
• unified_computing_system = 4.2(2a)
• unified_computing_system = 4.2(2f)
• unified_computing_system = 4.2(2g)
• unified_computing_system = 4.2(3b)
• unified_computing_system = 4.2(3d)
• unified_computing_system = 4.2(3e)
• unified_computing_system = 4.2(3g)
• unified_computing_system = 4.2(3h)
• unified_computing_system = 4.2(3i)
• unified_computing_system = 4.2(3j)
• unified_computing_system = 4.2(3l)
• unified_computing_system = 4.2(3m)
• unified_computing_system = 4.2(3n)
• unified_computing_system = 4.2(3o)
• unified_computing_system = 4.2(3p)
• unified_computing_system = 4.3(1.230097)
• unified_computing_system = 4.3(1.230124)
• unified_computing_system = 4.3(1.230138)
• unified_computing_system = 4.3(2.230207)
• unified_computing_system = 4.3(2.230270)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.