Cisco fixes vulnerabilities in Integrated Management Controller

Kyaw_Myo_Oo — Mon, 22 Apr 2024 15:24:22 GMT

Dear all,

Cisco has released patches for two privilege escalation vulnerabilities in its Integrated Management Controller (IMC) that is used for out-of-band management of many of its server products, as well as various appliances. The flaws could allow authenticated attackers to execute commands as root on the underlying operating system, one of them already has proof-of-concept exploit code available publicly.

The two vulnerabilities, tracked as CVE-2024-20295 and CVE-2024-20356, are rated 8.8 and 8.7 in the Common Vulnerability Scoring System (CVSS) which equates to high severity. Both can be exploited over the network if the IMC interfaces are remotely accessible, but the reason why they’re not rated critical is because the attackers need to be authenticated and have some privileges already.

https://www.csoonline.com/article/2093447/cisco-fixes-vulnerabilities-in-integrated-management-controller.html?utm_campaign=editorial&utm_medium=cso&utm_source=browseralert

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-mUx4c5AJ

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-bLuPcb

topic Cisco fixes vulnerabilities in Integrated Management Controller in Threats

Cisco fixes vulnerabilities in Integrated Management Controller