Cisco IMC API Authorization Bypass via Improper Checks (CVE-2020-26063)
CVE-2020-26063 Published on November 18, 2024
Cisco Integrated Management Controller Software Authorization Bypass Vulnerability
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization.
The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.
Vulnerability Analysis
CVE-2020-26063 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2020-26063
Want to know whenever a new CVE is published for Cisco Integrated Management Controller? stack.watch will email you.
Affected Versions
Cisco Unified Computing System (Managed):- Version 4.0(1a) is affected.
- Version 3.2(3n) is affected.
- Version 4.1(1a) is affected.
- Version 4.1(1b) is affected.
- Version 4.0(4h) is affected.
- Version 4.1(1c) is affected.
- Version 3.2(3k) is affected.
- Version 3.2(2c) is affected.
- Version 4.0(4e) is affected.
- Version 4.0(4g) is affected.
- Version 3.2(3i) is affected.
- Version 4.0(2e) is affected.
- Version 3.2(3g) is affected.
- Version 4.0(4a) is affected.
- Version 4.0(2d) is affected.
- Version 3.2(2d) is affected.
- Version 4.0(1b) is affected.
- Version 4.0(4f) is affected.
- Version 3.2(3h) is affected.
- Version 3.2(2f) is affected.
- Version 4.0(4c) is affected.
- Version 3.2(3a) is affected.
- Version 4.0(1c) is affected.
- Version 3.2(3d) is affected.
- Version 3.2(2b) is affected.
- Version 4.0(4b) is affected.
- Version 3.2(2e) is affected.
- Version 4.0(2b) is affected.
- Version 4.0(4d) is affected.
- Version 3.2(1d) is affected.
- Version 3.2(3e) is affected.
- Version 3.2(3l) is affected.
- Version 3.2(3b) is affected.
- Version 4.0(2a) is affected.
- Version 3.2(3j) is affected.
- Version 4.0(1d) is affected.
- Version 3.2(3o) is affected.
- Version 4.0(4i) is affected.
- Version 4.1(1d) is affected.
- Version 4.1(2a) is affected.
- Version 4.1(1e) is affected.
- Version 3.2(3p) is affected.
- Version 4.1(2b) is affected.
- Version 4.0\(1a\) is affected.
- Version 3.2\(3n\) is affected.
- Version 4.1\(1a\) is affected.
- Version 4.1\(1b\) is affected.
- Version 4.0\(4h\) is affected.
- Version 4.1\(1c\) is affected.
- Version 3.2\(3k\) is affected.
- Version 3.2\(2c\) is affected.
- Version 4.0\(4e\) is affected.
- Version 4.0\(4g\) is affected.
- Version 3.2\(3i\) is affected.
- Version 4.0\(2e\) is affected.
- Version 3.2\(3g\) is affected.
- Version 4.0\(4a\) is affected.
- Version 4.0\(2d\) is affected.
- Version 3.2\(2d\) is affected.
- Version 4.0\(1b\) is affected.
- Version 4.0\(4f\) is affected.
- Version 3.2\(3h\) is affected.
- Version 3.2\(2f\) is affected.
- Version 4.0\(4c\) is affected.
- Version 3.2\(3a\) is affected.
- Version 4.0\(1c\) is affected.
- Version 3.2\(3d\) is affected.
- Version 3.2\(2b\) is affected.
- Version 4.0\(4b\) is affected.
- Version 3.2\(2e\) is affected.
- Version 4.0\(2b\) is affected.
- Version 4.0\(4d\) is affected.
- Version 3.2\(1d\) is affected.
- Version 3.2\(3e\) is affected.
- Version 3.2\(3l\) is affected.
- Version 3.2\(3b\) is affected.
- Version 4.0\(2a\) is affected.
- Version 3.2\(3j\) is affected.
- Version 4.0\(1d\) is affected.
- Version 3.2\(3o\) is affected.
- Version 4.0\(4i\) is affected.
- Version 4.1\(1d\) is affected.
- Version 4.1\(2a\) is affected.
- Version 4.1\(1e\) is affected.
- Version 3.2\(3p\) is affected.
- Version 4.1\(2b\) is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.