What’s Vulnerable › Vulnerabilities

CVE-2021-1397: Cisco Integrated Management Controller Open Redirect Vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-06 · updated 2026-06-17
• Weakness: CWE-601

Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.

Affected products

• Cisco C125 M5 Firmware: through 4.1\(2f\)
• Cisco C220 M5 Firmware: through 4.1\(2f\)
• Cisco C220 M6 Firmware: through 4.1\(2f\)
• Cisco C225 M6 Firmware: through 4.1\(2f\)
• Cisco C240 M5 Firmware: through 4.1\(2f\)
• Cisco C240 M6 Firmware: through 4.1\(2f\)
• Cisco C245 M6 Firmware: through 4.1\(2f\)
• Cisco C480 M5 Firmware: through 4.1\(2f\)
• Cisco C480 Ml M5 Firmware: through 4.1\(2f\)
• Cisco Encs 5100 Firmware: through 4.4.2
• Cisco Encs 5400 Firmware: through 4.4.2
• Cisco Integrated Management Controller (IMC) Supervisor: before 3.2\(12.4\) — fixed in 3.2\(12.4\)
• Cisco Ucs-E1120D-M3 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E140D Firmware: through 3.2\(11.5\)
• Cisco Ucs-E140Dp Firmware: through 3.2\(11.5\)
• Cisco Ucs-E140S-M1 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E140S-M2 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E140S Firmware: through 3.2\(11.5\)
• Cisco Ucs-E160D Firmware: through 3.2\(11.5\)
• Cisco Ucs-E160Dp-M1 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E160S-M3 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E180D-M2 Firmware: through 3.2\(11.5\)
• Cisco Ucs-E180D-M3 Firmware: through 3.2\(11.5\)
• Cisco Ucs Manager: through 4.1\(3b\)
• Cisco Ucs S3260 Firmware: through 4.0\(2o\)

How to fix

Upgrade to a fixed version: Cisco Integrated Management Controller (IMC) Supervisor 3.2\(12.4\). Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-openred-zAYrU6d2
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-openred-zAYrU6d2

Get alerted when CVE-2021-1397 or the next vulnerability affects your stack