Cisco IMC CVE-2019-1907 Privilege Escalation Vulnerability

Key Information Vulnerability Name: Cisco Integrated Management Controller Substring Comparison Privilege Escalation Vulnerability Advisory ID: cisco-sa-20190821-imc-privescal CVE ID: CVE-2019-1907 CWE: CWE-285 CVSS Score: 8.8 Release Date: August 21, 2019 Risk Level: High Vulnerability Overview Description: This vulnerability exists in the web server of Cisco Integrated Management Controller (IMC), allowing an authenticated remote attacker to set sensitive configuration values and gain elevated privileges. Cause: Due to improper handling of substring comparison operations in the affected software, this vulnerability can be exploited by sending specially crafted HTTP requests. Impact: Successful exploitation can enable an attacker with read-only permissions to gain administrator privileges. Affected Products Affected Products: Cisco IMC software running in standalone mode on Cisco UCS C-Series and S-Series servers. Unaffected Products: UCS E-Series servers, 5000 Series Enterprise Network Computing Systems, and FI-connected servers managed by UCS Manager (including B, C, and S-Series servers). Solution & Workarounds Solution: Cisco has released free software updates to address this vulnerability. Workarounds: None. Fixed Versions Customers should upgrade to the corresponding Cisco UCS C-Series and S-Series software versions. See the fixed versions table for details. Vulnerability Discovery Source The vulnerability was discovered during internal security testing.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IMC CVE-2019-1907 Privilege Escalation Vulnerability