.webp)
A vulnerability, classified as CVE-2024-20295 (CVSSv3: 8.8) is present in the CLI of the Cisco Integrated Management Controller (IMC) which could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have read-only or higher privileges on an affected device. The Cisco PSIRT is aware of proof-of-concept exploit code that is available for the vulnerability, however they are not aware of any malicious use of it yet.
A successful exploitation of this vulnerability allows a local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. If exploited, this vulnerability would have a high impact because the attacker would have access to root privileges, which are the highest level of access a user can have. Root users can perform security and administrative functions.
Affected Products:
This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IMC in the default configuration:
Cisco appliances that are based on a preconfigured version of a Cisco UCS C-Series Server are also affected if they expose access to the Cisco IMC CLI. Cisco IMC is not directly accessible on these appliances, which significantly reduces the attack vector on these platforms.
At the time of publication, this included the following Cisco products:
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
For information about which Cisco software releases are vulnerable, see the Fixed Software section of the advisory. Details on updates for the affected products are there as well.
If you utilize this software or any of the affected products in your environment consult the advisory and apply updates where applicable. This may have to be coordinated with an engineering team, as the upgrade is to a server-related software/device.
As a result of exploitation, an attack can obtain access to root privileges in the command line interface of the Cisco Integrated Management Controller. This can allow the attacker to manage all aspects of the servers within the IMC’s Control. They could modify security settings, utilize SSH, and set a denial-of-service condition on the devices. This can cause monetary and data loss because of incident response and lack of access to the data or applications which live on those servers.
Patch: Patching the vulnerable device will remediate the vulnerability and prevent exploitation.
Prepare: Make sure the physical security of the local server is up to standard. Due to the attack vector being local, the best way to mitigate this vulnerability is to ensure an attacker cannot reach that server.
Cisco Integrated Management Controller CLI Command Injection Vulnerability
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
