Cisco UCS Central web interface allows remote code execution
Someone with an account on the server management software can run commands and steal information.
Summary
The web management interface of Cisco UCS Central Software does not sufficiently validate input in HTTP requests. An authenticated remote attacker with valid credentials can run commands, write files and obtain sensitive information, and the listed versions from 2.0(1a) through 2.1(2b) are affected.
Affected when
- Attacker holds valid user credentials on the device
- Versions 2.0(1a) through 2.1(2b)
What to do
Cisco has released updates, and there are no workarounds. Check that you run a version newer than 2.1(2b) and read Cisco's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen