Cisco Integrated Management Controller Privilege Escalation Vulnerability

TL;DR 📌

• A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges. This vulnerability is due to insufficient restrictions on access to internal services. An attacker with a valid user account could exploit this…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20261.

What happened 🕵️‍♂️

A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges.

This vulnerability is due to insufficient restrictions on access to internal services. An attacker with a valid user account could exploit this vulnerability by using crafted syntax when connecting to the Cisco IMC of an affected device through SSH. A successful exploit could allow the attacker to access internal services with elevated privileges, which may allow unauthorized modifications to the system, including the possibility of creating new administrator accounts on the affected device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability, but a mitigation is available.

Affected products 🖥️

This vulnerability affects the following Cisco products if they are running a vulnerable software release and they accept incoming SSH connections to the Cisco IMC:

UCS B-Series Blade Servers (CSCwk24502 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk24502”]) UCS C-Series Rack Servers (CSCwc06871 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc06871”]) UCS S-Series Storage Servers (CSCwc06871 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc06871”]) UCS X-Series Modular System (CSCwk24502 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk24502”])

Note: Cisco UCS C-Series and UCS S-Series Servers in standalone mode accept incoming SSH connections by default. For additional details, see the Configuring SSH section of the Cisco UCS C-Series Integrated Management Controller GUI Configuration Guide [“https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/gui/config/guide/4_3/b_cisco_ucs_c-series_gui_configuration_guide_43/b_Cisco_UCS_C-series_GUI_Configuration_Guide_41_chapter_01101.html#task_083E4199DCF1404486FC1C6F958CBE8C”]. Cisco UCS B-Series, Managed UCS C-Series, Managed UCS S-Series, and UCS X-Series Servers accept incoming SSH connections only if a Serial over LAN (SoL) policy is enabled on the associated Service Profile. For additional details, see the Serial over LAN Policy Settings section of the Cisco UCS Manager Server Management Guide [“https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/GUI-User-Guides/Server-Mgmt/4-3/b_cisco_ucs_manager_server_mgmt_guide_4_3/m_server-related_policy_configuration.html#d21614e28464a1635”].

Cisco appliances that are based on a preconfigured version of a Cisco UCS C-Series Server are also affected by this vulnerability if they expose SSH access to the Cisco IMC. At the time of publication, this included the following Cisco products:

Application Policy Infrastructure Controller (APIC) Servers Business Edition 6000 and 7000 Appliances Catalyst Center Appliances, formerly DNA Center Cisco Telemetry Broker Appliance Cloud Services Platform (CSP) 5000 Series Common Services Platform Collector (CSPC) Appliances Connected Mobile Experiences (CMX) Appliances Connected Safety and Security UCS Platform Series Servers Cyber Vision Center Appliances Expressway Series Appliances HyperFlex Edge Nodes HyperFlex Nodes IEC6400 Edge Compute Appliances IOS XRv 9000 Appliances Meeting Server 1000 Appliances Nexus Dashboard Appliances Prime Infrastructure Appliances Prime Network Registrar Jumpstart Appliances Secure Endpoint Private Cloud Appliances Secure Firewall Management Center Appliances, formerly Firepower Management Center Secure Malware Analytics Appliances Secure Network Analytics Appliances Secure Network Server Appliances Secure Workload Servers

For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability. However, there is a mitigation.

If it is not required, SSH access to the Cisco IMC of an affected device may be disabled.

For Cisco UCS C-Series and UCS S-Series Servers in standalone mode, choose Admin > Communication Services on the Cisco IMC web UI and uncheck the SSH Enabled option.

For Cisco UCS B-Series, Managed UCS C-Series, Managed UCS S-Series, and UCS X-Series Servers, disable the Serial over LAN (SoL) policy on the associated Service Profile (SoL access is disabled by default). From the Servers section of the Cisco UCS Manager web UI, do the following:

Choose the Service Profile in question. Click the Change Serial over LAN Policy link under Actions in the Policies tab. Choose the No Serial over LAN Policy option. Click OK.

Alternatively, edit the applied Serial Over LAN Policy under Policies > Serial Over LAN Policies and change the Serial over LAN State property from Enable to Disable. This would disable SoL access for all the Service Profiles that are using the SoL policy in question.

While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-ucs-ssh-priv-esc-2mZDtdjM
• Initial release: 2025-06-04T16:00:00 UTC
• Last updated: 2025-06-04T16:00:00 UTC

For leadership 🧭

Executive summary. Any UCS server family exposing SSH on its Integrated Management Controller can be turned into a full administrative takeover by someone who already holds a valid, low-privilege account. Given the scale of affected platforms, including many appliances built on UCS C-Series hardware, this needs mitigation or patching in the next scheduled change window, sooner if IMC SSH is internet- or broadly network-reachable.

Why it matters:

• A valid but low-privileged Cisco IMC account is enough to reach internal services and create new administrator accounts, turning limited access into full control of the management controller.
• Standalone UCS C-Series and S-Series servers accept SSH to the IMC by default, so exposure may exist without any deliberate configuration decision.
• The same underlying UCS C-Series platform is reused inside a long list of Cisco appliances (APIC, Catalyst Center, Secure Firewall Management Center, HyperFlex, Nexus Dashboard and others), so the flaw isn’t confined to obvious ‘server’ inventory.
• Fixed releases only exist for some trains; at least one train (5.1) has no patch and requires migration to a different release entirely.

Now / Next / Later:

• Now: Identify every UCS B/C/S/X-Series server and every UCS C-Series-based appliance in your estate, and check whether Cisco IMC SSH is enabled or an SoL policy is active on the associated service profile.
• Next: Where SSH access to the IMC isn’t operationally required, disable it (or disable the Serial over LAN policy for managed servers) during the next change window, and upgrade standalone/managed systems to the first fixed release for their train.
• Later: Build IMC/BMC SSH exposure into standard hardware provisioning checks so management-plane SSH and SoL policies default to disabled unless a documented operational need exists.