Cisco UCS Redfish API Command Injection Vulnerability (CVE-2024-20365)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Cisco UCS B-Series, Managed C-Series, and X-Series Servers Redfish API Command Injection Vulnerability - Vulnerability ID: cisco-sa-cimc-redfish-cominj-sbkv5ZZ - CVE Number: CVE-2024-20365 - CWE Number: CWE-77 - CVSS Score: Base 6.5 2. Affected Products: - Affected Products: Cisco UCS B-Series Blade Servers, Cisco UCS Managed C-Series Rack Servers, Cisco UCS X-Series Modular System - Affected Versions: Earlier versions (specific versions not specified) 3. Vulnerability Impact: - Vulnerability Description: Remote attackers can exploit this vulnerability to perform command injection attacks via the Redfish API and escalate privileges to root. - Mitigation: Cisco has released software updates to address this vulnerability. No workarounds exist for this vulnerability. 4. Affected Software Versions: - Affected Software Versions: Earlier versions (specific versions not specified) 5. Workarounds: - Workarounds: No workarounds exist for this vulnerability. 6. Remediation Software: - Remediation Software: Cisco recommends regularly checking for security updates for affected products. 7. Affected Devices: - Affected Devices: Cisco UCS B-Series Blade Servers, Cisco UCS Managed C-Series Rack Servers, Cisco UCS X-Series Modular System 8. Affected Device Modes: - Affected Device Modes: UCS Manager mode and Intersight mode. 9. Vulnerability Discovery: - Vulnerability Discovery: The vulnerability was discovered during internal security testing. 10. Vulnerability Link: - Vulnerability Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-redfish-cominj-sbkv5ZZ 11. Revision History: - Revision History: Version 1.0, Initial release date: October 2, 2024. This information helps understand the nature of the vulnerability, the affected products and software versions, mitigation measures, and how to remediate the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco UCS Redfish API Command Injection Vulnerability (CVE-2024-20365)