Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. These vulnerabilities are due to insufficient input validation of command arguments supplied by the user. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20294 |
Exploitation
To exploit these vulnerabilities, an attacker must first authenticate to the Cisco UCS Manager Software with administrative privileges. Once authenticated, the attacker can submit specially crafted input to the affected commands, which may lead to command injection and allow the execution of arbitrary commands with root-level privileges on the device.
Affected Products
- Cisco UCS Manager Software: A management tool for Cisco Unified Computing System (UCS) that allows for the management of physical and virtual resources.
Mitigation
To mitigate these vulnerabilities, it is recommended that users apply the latest security patches provided by Cisco for UCS Manager Software. Additionally, implementing strict access controls and monitoring for unusual activity can help reduce the risk of exploitation.