CVE-2021-34736: Cisco Integrated Management Controller GUI Denial of Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-21 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to cause the web-based management interface to unexpectedly restart. The vulnerability is due to insufficient input validation on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause the interface to restart, resulting in a denial of service (DoS) condition.

Affected products

Cisco Unified Computing System (Managed): before 4.1\(2g\); from 4.2 before 4.2\(1b\); before 4.1\(3e\) — fixed in 4.1\(2g\), 4.1\(3e\), 4.2\(1b\)

How to fix

Upgrade to a fixed version: Cisco Unified Computing System (Managed) 4.1\(2g\), 4.1\(3e\), 4.2\(1b\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34736 or the next vulnerability affects your stack