Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of user-supplied commands. An attacker who has administrator privileges and access to the network where the IPMI resides could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to gain root privileges on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-1634US | high7.2 | — | ||
A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Cisco Integrated Management Controller Command Injection Vulnerabilityself
- Cisco Security Vulnerability Policyexternal
- considering software upgradesexternal
- Software Centerexternal
- https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlexternal
- https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.htmlexternal
- Cisco Security Advisories and Alerts pageexternal
Behebungen (4)
- BehobenCisco 5000 Series Enterprise Network Compute System
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Computing System (Management Software)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Computing System (Standalone)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Computing System E-Series Software (UCSE)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan