Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service Vulnerability

Vulnerability

The vulnerability exists in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data. Due to a missing authentication check in an API call, an unauthenticated, remote attacker can cause all currently authenticated users to be logged off. The affected versions are those prior to fixed releases provided by Cisco [1].

Exploitation

An attacker can send a crafted request to the vulnerable API endpoint without any authentication. The attack requires network access to the affected system. No user interaction is needed. By sending a single request, the attacker can trigger a denial of service condition that logs off all current sessions. Repeated exploitation can prevent users from maintaining a session in the web-based management portal [1].

Impact

Successful exploitation results in a denial of service condition, preventing authenticated users from accessing the web-based management interface. The impact is limited to availability; no data confidentiality or integrity is compromised. The attacker does not gain any privileged access [1].

Mitigation

Cisco has released fixed software updates to address the vulnerability. Customers should upgrade to the appropriate fixed versions as indicated in the Cisco Security Advisory [1]. No workarounds are available. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.