Description
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user. Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Unified Computing System (Standalone) | 4.0(2g); 3.1(2i); 3.1(1d); 4.0(4i); 4.1(1c); 4.0(2c); 4.0(1e); 4.0(2h); 4.0(4h); 4.0(1h); 4.0(2l); 3.1(3g); 4.0(1.240); 4.0(2f); 4.0(1g); 4.0(2i); 3.1(3i); 4.0(4d); 4.1(1d); 3.1(3c) |
References
Timeline
- Published
- Apr 1, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Analyzed