Vulnerability · Published Nov 18, 2024 · Assigned by cisco

CVE-2020-26062Cisco Integrated Management Controller Username Enumeration Vulnerability

Medium 5.3

In plain English

A medium-severity security flaw in Cisco Unified Computing System (Managed) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 41.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to the affected application. A successful exploit could allow the attacker to confirm the names of administrative user accounts for use in further attacks.There are no workarounds that address this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Unified Computing System (Managed)	4.0(1a)3.2(3n)4.1(1a)4.1(1b)4.0(4h)4.1(1c)3.2(3k)3.2(2c)

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/RL:X/RC:X/E:X

In plain English

Official description

Affected products (as reported)

References