CVE-2017-6616
HighSummary
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize specific values that are received as part of a user-supplied HTTP request.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user on the affected system, posing a serious security risk to the organization.
Recommendation
It is recommended to update the software to the latest version that includes security patches and to monitor logs for potential exploitation attempts.
Other vulnerabilities in Cisco Integrated Management Controller (IMC) 3.0(1c)
Original NVD description (English source)
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize specific values that are received as part of a user-supplied HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the user on the affected system. Cisco Bug IDs: CSCvd14578.