Cisco CIMC Username Enumeration Vulnerability (CVE-2020-26062) Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Cisco Integrated Management Controller Username Enumeration Vulnerability - Vulnerability ID: cisco-sa-cimc-enum-CyheP3B7 - CVE Number: CVE-2020-26062 - CVSS Score: Base 5.3 2. Affected Products: - Affected Product: Cisco UCS C-Series Servers - Affected Versions: Cisco Integrated Management Controller releases 4.0(4h)C and earlier 3. Vulnerability Impact: - Description: Allows unauthorized remote attackers to enumerate valid usernames. - Cause: Due to differences in authentication responses, which are sent back to the application during authentication attempts. - Exploitation: Attackers can exploit this vulnerability by sending authentication requests. Successful exploitation allows attackers to confirm the names of management user accounts, which can be used for further attacks. 4. No Workarounds: - No Workarounds: There are no workarounds available to mitigate this vulnerability. 5. Affected Products List: - Affected Products: Only the products listed in the Affected Products section are affected. 6. Fix Software: - Recommendation: It is recommended to regularly review Cisco product security advisories to determine exposure and obtain complete upgrade solutions. - Note: Ensure upgraded devices have sufficient memory, and confirm that current hardware and software configurations will continue to be supported in the new version. 7. Public Disclosure and Malicious Use: - Public Disclosure: Cisco Product Security Incident Response Team (PSIRT) has not identified any public disclosures or malicious use of this vulnerability. 8. Source: - Acknowledgment: Thanks to Leonidas Tsaousis and Thomas Large of F-Secure Consulting for reporting this vulnerability. 9. URL: - Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-enum-CyheP3B7 10. Revision History: - Version: 1.0 - Description: Initial public release. - Status: Final - Date: November 4, 2020 11. Legal Disclaimer: - Disclaimer: This document is provided "AS IS" without any warranty or guarantee, including implied warranties of merchantability or fitness for a particular purpose. The risk of using this document or any materials linked to it is solely at the user’s own discretion. Cisco reserves the right to modify or update this document at any time. This information provides a detailed description of the vulnerability, affected products, exploitation methods, remediation recommendations, and disclaimers.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco CIMC Username Enumeration Vulnerability (CVE-2020-26062) Advisory