A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to read, create, or overwrite files on the underlying operating system of an affected device. This issue arises from insufficient input validation of command arguments supplied by the user. A successful exploit could compromise system files, making it critical for affected users to address this vulnerability promptly.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2025-20295 |
Exploitation
To exploit this vulnerability, an attacker must authenticate to the affected device using valid administrative credentials. Once authenticated, the attacker can submit crafted input to the affected command, which could allow them to read, create, or overwrite files on the system, including critical system files.
Affected Products
- Cisco UCS Manager Software: A management tool for Cisco Unified Computing System that may be compromised due to this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper input validation and restrict access to the CLI for administrative users. Regularly updating the software and monitoring for unauthorized access can also help in reducing the risk associated with this vulnerability.