Cisco fixes vulnerabilities in Integrated Management Controller

[Kyaw_Myo_Oo]

Dear all,

Cisco has released patches for two privilege escalation vulnerabilities in its Integrated Management Controller (IMC) that is used for out-of-band management of many of its server products, as well as various appliances. The flaws could allow authenticated attackers to execute commands as root on the underlying operating system, one of them already has proof-of-concept exploit code available publicly.

The two vulnerabilities, tracked as CVE-2024-20295 and CVE-2024-20356, are rated 8.8 and 8.7 in the Common Vulnerability Scoring System (CVSS) which equates to high severity. Both can be exploited over the network if the IMC interfaces are remotely accessible, but the reason why they’re not rated critical is because the attackers need to be authenticated and have some privileges already.

https://www.csoonline.com/article/2093447/cisco-fixes-vulnerabilities-in-integrated-management-contr...

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-...

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-...