Product:
UCS Manager Software
Summary
A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system. This vulnerability exists because unnecessary privileges are given to the user. An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2026-20037 |
Exploitation
An attacker can exploit this vulnerability by authenticating to the affected device as a read-only user. Once authenticated, the attacker can access the NX-OS CLI and perform unauthorized actions, such as creating or overwriting files in the file system. This exploitation is possible due to the excessive privileges granted to the read-only user role.
Affected Products
- UCS Manager Software: Vulnerable due to improper privilege levels allowing unauthorized file modifications.
Mitigation
To mitigate this vulnerability, it is recommended to review and restrict user privileges within the UCS Manager Software. Ensure that users are assigned only the necessary permissions required for their roles. Regular audits of user access levels can help prevent unauthorized actions.