Cisco discloses root escalation flaw with public exploit code

Cisco disclosed a high-severity CLI command-injection vulnerability (CVE-2024-20295) in its Integrated Management Controller (IMC) affecting multiple product lines (ENCS 5000, Catalyst 8300 uCPE, UCS C-Series standalone, UCS E-Series) that can allow an authenticated local attacker with read-only or greater access to execute crafted commands and gain root; proof-of-concept exploit code is publicly available and Cisco has issued patches, with no confirmed widespread exploitation reported.