CVE-2020-3470

Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the API subsystem of an affected system. When this request is processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying operating system (OS).

• Cisco C125 M5

  HW
  Cisco
  all versions

• Cisco C220 M5

  HW
  Cisco
  all versions

• Cisco C240 M5

  HW
  Cisco
  all versions

• Cisco C480 M5

  HW
  Cisco
  all versions

• Cisco C480 Ml M5

  HW
  Cisco
  all versions

• Cisco Enterprise Network Compute System 5100

  HW
  Cisco
  all versions

• Cisco Enterprise Network Compute System 5400

  HW
  Cisco
  all versions

• Cisco Enterprise Nfv Infrastructure Software

  APP
  Cisco
  < 4.4.1

• Cisco Integrated Management Controller

  APP
  Cisco
  < 3.2.11.34.0\(1a\) – 4.0\(4l\)3.0\(1c\) – 3.0\(4q\)4.0\(1a\) – 4.0\(2l\)4.1\(1c\) – 4.1\(1f\)3.1 – 4.0\(4l\)

• Cisco Ucs C220 M3

  HW
  Cisco
  all versions

• Cisco Ucs C220 M4

  HW
  Cisco
  all versions

• Cisco Ucs C22 M3

  HW
  Cisco
  all versions

• Cisco Ucs C240 M3

  HW
  Cisco
  all versions

• Cisco Ucs C24 M3

  HW
  Cisco
  all versions

• Cisco Ucs C420 M3

  HW
  Cisco
  all versions

• Cisco Ucs C460 M4

  HW
  Cisco
  all versions

• Cisco Ucs E Series M1

  HW
  Cisco
  all versions

• Cisco Ucs E Series M2

  HW
  Cisco
  all versions

• Cisco Ucs E Series M3

  HW
  Cisco
  all versions

• Cisco Ucs S3160

  HW
  Cisco
  all versions

• Cisco Ucs S3260

  HW
  Cisco
  all versions