CVE-2020-26063: Cisco Integrated Management Controller Software Authorization Bypass Vulnerability
First published: Mon Nov 18 2024(Updated: )
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Integrated Management Controller Supervisor |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD
Frequently Asked Questions
What is the severity of CVE-2020-26063?
CVE-2020-26063 has been classified as a high severity vulnerability due to its potential impact on system authorization.
How do I fix CVE-2020-26063?
To address CVE-2020-26063, it is recommended to update the Cisco Integrated Management Controller to the latest version provided by Cisco.
What type of vulnerability is CVE-2020-26063?
CVE-2020-26063 is an authorization bypass vulnerability found in the API endpoints of Cisco Integrated Management Controller.
Who is affected by CVE-2020-26063?
CVE-2020-26063 affects users of Cisco Integrated Management Controller that have improperly configured authorization checks.
Can CVE-2020-26063 be exploited remotely?
Yes, CVE-2020-26063 can be exploited remotely by an authenticated attacker to perform unauthorized actions on the system.
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco integrated management controller supervisor