Cisco Secure Endpoint Private Cloud Firmware Upgrade for CVE-2024-20356

Available Languages

Download Options

  • PDF     (82.5 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (132.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (123.6 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:June 17, 2024
Document ID:222008

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Introduction

Remediation of CVE-2024-20356 requires an update to the CIMC firmware for the Cisco Secure Endpoint Private Cloud appliance. This article describes the process of upgrading the firmware of a Private Cloud UCS appliance.

Prerequisites

  • Secure Endpoint Private Cloud UCS Appliance with Private Cloud version 3.9.x or above.
  • Access to the Private Cloud UCS Appliance CIMC web UI (including access to the web based KVM).

Required Downtime

The firmware upgrade takes approximately 40 minutes to complete. During this time the Cisco Secure Endpoint functionality will not be available.

After the firmware upgrade is complete, the UCS appliance will be rebooted. This can take another 10 minutes. 

Total downtime is approximately 50 minutes.

Firmware Upgrade Steps

Proxy or Connected Mode

  1. Run the following commands on the appliance command line (either through SSH or CIMC KVM): yum install -y ucs-firmware
  2. In your web browser, log into the CIMC web UI of the appliance and open the KVM console.
  3. Reboot the appliance with (either from SSH or the CIMC KVM console): amp-ctl reboot
  4. In the CIMC KVM console, wait for the appliance to reboot. In the boot loader menu, a new "UCS Appliance Firmware Update" menu item will be available (see screenshot below).
  5. The boot loader will wait a couple of seconds before booting the normal appliance. Use the down arrow to select "UCS Appliance Firmware Update" and press enter.
  6. The appliance will boot into the firmware updater, update the firmware and reboot the appliance.
  7. The CIMC may log you out during this process.

Menu options

Airgap Mode

  1. Create a new update ISO using amp-sync.
  2. Mount the update ISO as for a normal appliance update.
  3. Run the following commands on the appliance command line (either through SSH or CIMC KVM): yum install -y ucs-firmware
  4. In your web browser, log into the CIMC web UI of the appliance and open the KVM console.
  5. Reboot the appliance with (either from SSH or the CIMC KVM console): amp-ctl reboot
  6. In the CIMC KVM console, wait for the appliance to reboot. In the boot loader menu, a new "UCS Appliance Firmware Update" menu item will be available (see screenshot above).
  7. The boot loader will wait a couple of seconds before booting the normal appliance. Use the down arrow to select "UCS Appliance Firmware Update" and press enter.
  8. The appliance will boot into the firmware updater, update the firmware and reboot the appliance.
  9. The CIMC may log you out during this process.

Verification Steps

  1. In the CIMC web UI, go to the menu: Admin -> Firmware Management (see example screenshot below).
  2. The BMC version should be 4.3(2.240009).

Firmware management

Revision History

Revision Publish Date Comments
1.0
17-Jun-2024
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products