Cisco UCS Manager Software Command Injection Vulnerability Allowing Privilege Escalation to Root

A command injection vulnerability has been identified in Cisco UCS Manager Software, affecting the CLI and web-based management interface. This vulnerability allows an authenticated, remote attacker with administrative privileges to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges. The issue arises from insufficient input validation of command arguments provided by the user. Exploitation involves authenticating to a device and submitting crafted input to the affected commands.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the affected device's operating system with root-level privileges.

Remediation

Cisco has released software updates to address this vulnerability. For guidance on upgrading, consult the Cisco Security Advisories page or contact the Cisco Technical Assistance Center (TAC) or your maintenance provider.