CVE-2024-20365
Cisco Integrated Management Controller Redfish Command Injection Vulnerability
Description
A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by sending crafted commands through the Redfish API on an affected device. A successful exploit could allow the attacker to elevate privileges to root.
Weakness: CWE-77
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Unified Computing System (UCS) | Other Products | cna-assigner |
Vendor-reported products (2)
- Cisco · Cisco Unified Computing System (Managed)
- cisco · unified_computing_system_manager_firmware
Vendor advisory
cisco-sa-cimc-redfish-cominj-sbkv5ZZ
Cisco UCS B-Series, Managed C-Series, and X-Series Servers Redfish API Command Injection Vulnerability
Cisco’s rating: Medium (advisory CVSS 6.5) · Published Oct 2, 2024
Bug ID: CSCwj57330
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from