Cisco Patches Critical IMC and SSM Flaws - Immediate Action Required
Basically, Cisco fixed serious security holes that could let hackers control systems remotely.
Cisco has patched critical vulnerabilities in its IMC and SSM products, allowing remote attackers to gain elevated access. Users must update their systems immediately to mitigate risks.
What Happened
Cisco has released urgent updates to address two critical vulnerabilities in its Integrated Management Controller (IMC) and Smart Software Manager (SSM). These flaws could allow unauthenticated remote attackers to gain elevated privileges, posing a significant risk to affected systems.
The vulnerabilities are tracked as CVE-2026-20093 and CVE-2026-20160, both carrying a CVSS score of 9.8, indicating their severity. If exploited, attackers could bypass authentication and manipulate user accounts, including administrative access.
The Flaw
The first vulnerability, CVE-2026-20093, arises from incorrect handling of password change requests. An attacker can exploit this flaw by sending a specially crafted HTTP request to the affected device. This could allow them to alter passwords for any user, including admin accounts.
The second flaw, CVE-2026-20160, affects the SSM On-Prem and allows attackers to execute arbitrary commands on the underlying operating system. This vulnerability results from the unintentional exposure of an internal service, enabling attackers to send crafted requests to the API.
What's at Risk
Both vulnerabilities affect a range of Cisco products, including:
- 5000 Series Enterprise Network Compute Systems (ENCS)
- Catalyst 8300 Series Edge uCPE
- UCS C-Series M5 and M6 Rack Servers
- UCS E-Series Servers M3 and M6
If left unpatched, these vulnerabilities could lead to unauthorized access and control over critical systems, making them a prime target for cybercriminals.
Patch Status
Cisco has released patches for these vulnerabilities:
- IMC flaw fixed in versions 4.15.5, 4.18.3, and others.
- SSM On-Prem flaw patched in version 9-202601.
These updates are crucial to mitigate the risk of exploitation. Cisco has emphasized that, while there are no known exploits in the wild, the potential for future attacks remains high.
Immediate Actions
Users are urged to:
- Update to the latest patched versions immediately.
- Review system configurations to ensure no unauthorized changes have been made.
- Monitor for unusual activity that may indicate attempted exploitation.
By taking these steps, organizations can significantly reduce their vulnerability to these critical threats.