Product: Cisco UCS Manager Software
Summary
A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to read or create a file or overwrite any file on the file system of the underlying operating system of an affected device, including system files. This vulnerability is due to insufficient input validation of command arguments supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2025-20295 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials on the affected device. Once authenticated, the attacker can submit crafted input to the affected command, which could allow them to read, create, or overwrite files on the device’s file system, including critical system files.
Affected Products
- Cisco UCS Manager Software: Affected version allows local authenticated attackers to manipulate files on the underlying operating system.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper access controls are in place and limit administrative access to trusted personnel only. Regularly updating the software and monitoring for unauthorized access attempts can also help reduce the risk of exploitation.