Critical Cisco IMC Vulnerability Lets Attackers Bypass Authentication (CVE-2023-20164)

Key Takeaways

• A critical authentication bypass vulnerability (CVE-2023-20164) has been discovered in Cisco’s Integrated Management Controller (IMC).
• The flaw, rated 9.8 CVSS, allows unauthenticated remote attackers to gain full administrative control over affected systems.
• Numerous Cisco hardware products and appliances running vulnerable IMC software are impacted, including specific UCS C-Series, E-Series, ENCS, and Catalyst 8300 Series devices.
• No workarounds exist; immediate application of Cisco’s official software updates is the only effective mitigation.

Critical Cisco IMC Flaw Exposes Systems to Full Administrative Compromise

Cisco has issued an urgent security advisory regarding a severe vulnerability within its Integrated Management Controller (IMC) software, urging immediate updates for affected systems. The flaw, identified as CVE-2023-20164, carries a critical CVSS Base Score of 9.8, signifying its extreme severity and potential for widespread impact.

The core issue resides in the password change mechanism of the Cisco IMC. Specifically, the system incorrectly processes incoming requests intended to modify user passwords. This critical defect allows a remote attacker, even without any prior authentication, to craft and send a malicious HTTP request to a vulnerable device.

Successful exploitation of this vulnerability enables the attacker to completely circumvent the standard authentication protocols. Once authentication is bypassed, the malicious actor can then alter the passwords for any existing user account on the system. This includes the highly privileged Administrator account, effectively granting the attacker full administrative control and the ability to hijack the system.

Affected Products and Appliances

The scope of this vulnerability extends to several Cisco hardware products operating with susceptible versions of the IMC software. Standalone products confirmed to be at risk include:

• Cisco 5000 Series Enterprise Network Compute Systems (ENCS)
• Cisco Catalyst 8300 Series Edge uCPE
• Cisco UCS C-Series M5 and M6 Rack Servers (when configured in standalone mode)
• Cisco UCS E-Series Servers M3 and M6

Beyond standalone units, various Cisco appliances are also vulnerable if they incorporate preconfigured UCS C-Series Servers and expose the Cisco IMC user interface. This broad category encompasses Cisco Application Policy Infrastructure Controller (APIC) Servers, Catalyst Center Appliances, Secure Firewall Management Center Appliances, and Secure Network Analytics Appliances.

Cisco has confirmed that certain newer or distinct product lines are not impacted by this particular flaw, including UCS B-Series Blade Servers, UCS X-Series Modular Systems, and UCS C-Series M7 and M8 Rack Servers.

What You Should Do

Cisco has stated that no temporary workarounds or alternative mitigations are available to block this critical vulnerability. The only definitive solution is to apply the official software updates provided by Cisco. Administrators are strongly advised to take immediate action to upgrade their affected systems to the fixed software releases.

• Apply Updates Immediately: Upgrade all affected Cisco IMC software to the patched versions as outlined in the official Cisco Security Advisory.
• Understand Device-Specific Updates: Be aware that the update procedure may vary. For instance, upgrading IMC on 5000 Series ENCS and Catalyst 8300 Series devices necessitates upgrading the underlying Cisco Enterprise NFV Infrastructure Software (NFVIS).
• Utilize Host Upgrade Utility: For standalone servers, administrators should typically use the Cisco Host Upgrade Utility (HUU) to install the necessary IMC releases.
• Monitor for Exploitation: While Cisco reports no evidence of active exploitation or public disclosure of malicious use at present, organizations should remain vigilant and monitor their systems for any suspicious activity.

Cisco has acknowledged a security researcher for reporting this vulnerability. There is currently no indication that this flaw has been actively exploited in the wild.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.