Product:
Cisco FXOS Software and Cisco UCS Manager Software
Summary
A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. This vulnerability is due to insufficient input validation of command arguments supplied by the user. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-20099 |
Exploitation
An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. Given the low attack complexity and the requirement for administrative privileges, an attacker with access to the system could easily manipulate command arguments to execute arbitrary commands.
Affected Products
- Cisco FXOS Software: Affected by command injection vulnerability allowing privilege escalation.
- Cisco UCS Manager Software: Vulnerable to similar command injection attacks that can lead to root access.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper input validation is implemented and that access controls are strictly enforced. Regular updates and patches from Cisco should be applied to maintain security and prevent exploitation.