What it is about

Der Cisco Integrated Management Controller ist eine Serververwaltung für mehrere Cisco-Produkte. Cisco Secure Endpoint bietet Virenschutz und erweiterte Endpunkt-Erkennung und -Reaktion. Das Cisco Secure Firewall Management Center ist eine zentralisierte Plattform, die eine Verwaltung und Überwachung von Cisco Firewall-Geräten ermöglicht. Cisco Secure Network Server bietet Dienste zur Identitäts- und Zugriffsverwaltung. Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen im Cisco Integrated Management Controller ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Code mit Root-Rechten auszuführen.

Under what conditions?

Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.

What can happen in the worst case

An attacker could use the vulnerability to

• einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Code mit Root-Rechten auszuführen

Am I affected?

Affected according to the BSI:

• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS <4.12.8
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS <4.15.6
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.12.8
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.15.6
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.18.5
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <26.1.2
• Cisco Integrated Management Controller UCS C-Series M5 Rack Server <4.2(3r)
• Cisco Integrated Management Controller UCS C-Series M5 Rack Server <4.3(2.260020)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server <4.2(3r)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server <4.3(6.260054)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server <6.0(2.260143)
• Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server <4.3(6.260033)

and 12 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS 4.12.8
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS 4.15.6
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE 4.12.8
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE 4.15.6
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE 4.18.5
• Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE 26.1.2
• Cisco Integrated Management Controller UCS C-Series M5 Rack Server 4.2(3r)
• Cisco Integrated Management Controller UCS C-Series M5 Rack Server 4.3(2.260020)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server 4.2(3r)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server 4.3(6.260054)
• Cisco Integrated Management Controller UCS C-Series M6 Rack Server 6.0(2.260143)
• Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server 4.3(6.260033)

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.