CVE-2024-20365 Overview
CVE-2024-20365 is a command injection vulnerability in the Redfish API of Cisco Unified Computing System (UCS) B-Series, UCS Managed C-Series, and UCS X-Series Servers. The flaw allows an authenticated, remote attacker holding administrative privileges to inject arbitrary operating system commands through the management interface. Successful exploitation elevates the attacker from the administrative role to root on the underlying Cisco Integrated Management Controller (CIMC). The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.
Critical Impact
An authenticated administrator can break out of the management API's authorization boundary and gain full root-level control of the CIMC, compromising the confidentiality, integrity, and availability of the server platform.
Affected Products
- Cisco UCS B-Series Servers running vulnerable Unified Computing System firmware
- Cisco UCS Managed C-Series Servers running vulnerable Unified Computing System firmware
- Cisco UCS X-Series Servers running vulnerable Unified Computing System firmware (versions 4.1(2a) through 4.3(4b))
Discovery Timeline
- 2024-10-02 - CVE-2024-20365 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-20365
Vulnerability Analysis
The vulnerability resides in the Redfish API implementation exposed by the CIMC on affected Cisco UCS servers. Redfish is a RESTful management standard used to configure and monitor server hardware. The API endpoint accepts parameters that are passed to an underlying shell or system call without sufficient neutralization. An attacker who is already authenticated with administrative rights can craft HTTP requests containing shell metacharacters or command separators. These payloads are then concatenated into the command executed by the CIMC service. Because that service runs with elevated privileges, injected commands execute as root, bypassing the intended role separation between the administrative API and the underlying operating system.
Root Cause
The root cause is insufficient input validation on parameters accepted by the Redfish API. User-supplied data is embedded into command strings without proper escaping or an allow-list of acceptable characters. This aligns with [CWE-77], where special command elements are not neutralized before being passed to a downstream component.
Attack Vector
Exploitation requires network access to the Redfish API and valid administrative credentials. The attacker sends a crafted HTTP request to a vulnerable API endpoint with shell metacharacters embedded in a request field. The CIMC concatenates the value into a command, executes it, and returns control at the root level. This vector is particularly useful to attackers who have compromised administrative credentials and wish to persist on out-of-band management hardware below the operating system layer.
No public proof-of-concept has been published for CVE-2024-20365. See the Cisco Security Advisory for authoritative technical details.
Detection Methods for CVE-2024-20365
Indicators of Compromise
- Unexpected Redfish API requests to CIMC endpoints containing shell metacharacters such as ;, |, &&, backticks, or $()
- New or unexplained processes running as root on the CIMC that do not correspond to normal management activity
- Unauthorized configuration changes, firmware modifications, or new local accounts on affected UCS servers
Detection Strategies
- Enable and forward CIMC audit and syslog data to a centralized logging platform for inspection of Redfish API activity
- Alert on Redfish HTTP request bodies or URIs that contain command-injection patterns targeting endpoints that accept user-supplied strings
- Correlate administrative logins to the CIMC with subsequent anomalous outbound connections from the management network
Monitoring Recommendations
- Baseline normal Redfish API usage per administrator and flag deviations in request volume, source IP, or endpoint targeted
- Monitor authentication logs for administrative logons from unexpected geographies or service accounts
- Restrict and log all traffic to the CIMC management VLAN, treating any lateral movement toward it as high priority
How to Mitigate CVE-2024-20365
Immediate Actions Required
- Apply the fixed Unified Computing System firmware release identified in the Cisco Security Advisory for your specific UCS server family
- Rotate all CIMC administrative credentials and revoke any suspected compromised accounts
- Restrict Redfish API exposure to a dedicated, isolated management network reachable only by authorized administrators
Patch Information
Cisco has released fixed software for affected UCS B-Series, UCS Managed C-Series, and UCS X-Series Servers. Refer to the Cisco Security Advisory cisco-sa-cimc-redfish-cominj-sbkv5ZZ for the fixed release matrix that covers versions in the 4.1, 4.2, and 4.3 trains through 4.3(4b).
Workarounds
- Cisco has not published a workaround; apply the vendor-supplied firmware update as the primary remediation
- Enforce strict role-based access control so that only a minimum number of accounts hold CIMC administrative privileges
- Require multi-factor authentication and jump-host access for reaching the CIMC management interface
- Place the CIMC on a segmented out-of-band management network with ACLs blocking access from user and server production VLANs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
