漏洞概述 漏洞名称: Cisco Integrated Management Controller Authentication Bypass Vulnerability (Cisco 集成管理控制器身份验证绕过漏洞) 严重性: Critical (严重) CVSS评分: Base 9.8 漏洞描述: 在Cisco集成管理控制器(IMC)的更改密码功能中存在漏洞。攻击者可以通过向受影响设备发送特制的HTTP请求来利用此漏洞。成功的利用允许攻击者在绕过身份验证后，以系统管理员身份访问系统。 原因: 由于错误处理密码更改请求。 影响范围 此漏洞影响运行易受攻击版本的Cisco IMC的以下Cisco产品： 5000 Series Enterprise Network Compute Systems (ENCS) Catalyst 8300 Series Edge uCPE UCS C-Series M5 and M6 Rack Servers (standalone mode) UCS E-Series Servers M3 UCS E-Series Servers M6 以及基于预配置版本的Cisco UCS C-Series Servers的Cisco设备（如果暴露了Cisco IMC UI访问权限），包括： Application Policy Infrastructure Controller (APIC) Servers Business Edition 6000 and 7000 Appliances Catalyst Center Appliances Cisco Telemetry Broker Appliances Cloud Services Platform (CSP) 5000 Series Common Services Platform Collector (CSPC) Appliances Connected Mobile Experiences (CMX) Appliances Connected Safety and Security UCS Platform Series Servers Cyber Vision Center Appliances Expressway Series Appliances HyperFlex Edge Nodes HyperFlex Nodes in HyperFlex Datacenter without Fabric Interconnect (DC-No-Fi) deployment mode IEC6400 Edge Compute Appliances IOS Xrv 9000 Appliances Meeting Server 1000 Appliances Nexus Dashboard Appliances Prime Infrastructure Appliances Prime Network Registrar Jumpstart Appliances Secure Endpoint Private Cloud Appliances Secure Firewall Management Center Appliances Secure Malware Analytics Appliances Secure Network Analytics Appliances Secure Network Server Appliances Secure Workload Servers 确认不受影响的产品: UCS B-Series Blade Servers, UCS C-Series M7 and M6 Rack Servers (standalone mode), UCS C-Series Rack Servers with Fabric Interconnects (IMM), UCS S-Series Storage Servers, UCS X-Series Modular System, Unified Edge。 修复方案 变通方法: 无 (There are no workarounds that address this vulnerability.) 固定软件版本 (Fixed Software Releases): Cisco建议升级到以下修复版本： 5000 Series ENCS and Catalyst 8300 Series Edge uCPE: 4.15 and earlier -> 4.15.5 4.16 and earlier -> Migrate to a fixed release. 4.18 -> 4.18.3 (Apr 2020) 26.1 -> Not vulnerable. UCS C-Series M5 Rack Server: 4.2 and earlier -> Migrate to a fixed release. 4.3 -> 4.32 (260007) UCS C-Series M6 Rack Server: 4.2 and earlier -> Migrate to a fixed release. 4.3 -> 4.36 (260017) 6.0 -> 6.01 (250174) UCS E-Series M3: 3.2 and earlier -> 3.2.17 UCS E-Series M6: 4.15 and earlier -> 4.15.3 其他设备固件升级命令/路径: Cisco Telemetry Broker Appliances: IEC6400 Edge Compute Appliances: Secure Endpoint Private Cloud Appliances: Secure Firewall Management Center Appliances: Secure Malware Analytics Appliances: Secure Network Analytics Appliances: * Secure Network Server Appliances: