CVE-2024-20356: high-severity vulnerability in Cisco Unified Computing System E-Series…
Published · Updated
Follow this CVE+ Monitor Cisco Unified Computing System+ Monitor Cisco Unified Computing System E-Series
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
26Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 30%
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected products
Cisco · Cisco Unified Computing System E-Series Software (UCSE)Cisco · Cisco Unified Computing System (Standalone)Related CVEs — Cisco Unified Computing System E-Series…
In the same product, most dangerous first.
CVE-2020-3470CRITICALCisco Integrated Management Controller Multiple Remote Code Execution VulnerabilitiesEPSS 4.8%CVE-2018-0430—Cisco Integrated Management Controller Command Injection VulnerabilityEPSS 4.0%CVE-2018-0431—Cisco Integrated Management Controller Command Injection VulnerabilityEPSS 4.0%CVE-2019-1865HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.6%CVE-2019-1850HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.5%CVE-2019-1634HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 2.8%