CVE-2019-1883: Cisco Integrated Management Controller Supervisor

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input on the command-line interface. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow an attacker to execute arbitrary commands on the device with root privileges.

Affected products

• Cisco Integrated Management Controller Supervisor: from 3.0.0.0, before 3.0\(4k\) (fixed in 3.0\(4k\)); from 4.0.0.0, before 4.0\(4b\) (fixed in 4.0\(4b\)); from 4.0.0.0, before 4.0\(2f\) (fixed in 4.0\(2f\))
• Cisco Unified Computing System: version 4.0(1c)hs3 only

Published 2019-08-21. Last modified 2026-06-17.