+49 89 89082-110
This vulnerability is an argument injection into a process call in the web application of the Cisco Integrated Management Controller (Cisco IMC), resulting in code execution and system takeover as root.
Introduction
Cisco IMC is used for deployment, ongoing management, health monitoring, and alerting for Cisco UCS C-Series rack servers and S-Series storage servers as an out-of-band management platform
It is used to update the BIOS, configure SecureBoot, and can thus interact with the operating systems running on the server. It is comparable to Dell iDRAC, or HPE Integrated Lights-Out (ILO).
Description
The Cisco IMC web application allows users to update their SSH public key for SSH access to the system using different methods, like pasting it, uploading it as file, or even download it from a different server via FTP or for example HTTP.
When instructing the web application to fetch a SSH key from another server, for example using HTTP, a request is made, which executes the following script with parameters in the backend:
/etc/scripts/download_ssh_keys.sh http 123.123.123.123 /tmp/example.ssh.pub
This script, simply put, takes the different parameters and puts them into curl.
Because the parameters are not filtered completely, it is possible to insert curl arguments into the request, and thus controlling the curl command, which can do quite much, like read or write of files, and even executing commands using loaded libraries.
Risk
The full control over the curl command results in an arbitrary file up- and download, as well as a command execution resulting in a full system takeover as root, because the script and curl is executed as root.
Solution/Mitigation
Update to the latest fixed version with the vulnerability closed. Alternatively, if not possible, disable the Web-UI completely.
Disclosure Timeline
2026-02-04: Contacted vendor over customer helpdesk ticket
2026-02-06: Vendor requests technical proof
2026-02-09: Technical proof sent to vendor
2026-02-10: Vendor confirms vulnerability and requests POC code
2026-02-11: POC code is sent over encrypted communication canal
2026-02-17: Vendor can reproduce vulnerability and works on a fix
2026-03-20: Vendor still assesses systems and works on a fix
2026-05-13: Vendor still assesses systems and works on a fix
2026-06-19: Vendor still assesses systems and works on a fix
2026-08-05: Patch is released
2026-08-05: CVE published
2026-08-05: Advisory and Blog article published by NSIDE
2026-08-05: Toolkit / Proof-of-Concept (POC) released on GitHub
Contact/Credits
The vulnerability was discovered during an assessment by Christoph Peil of NSIDE ATTACK LOGIC GmbH.
Disclaimer
The information in this security advisory is provided „as is“ and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The most recent version of this security advisory can be found at NSIDE ATTACK LOGIC GmbH’s website.