Cisco UCS Manager Software Command Injection Vulnerability Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in Cisco UCS Manager Software, affecting the CLI and web-based management interface. This vulnerability allows an authenticated, remote attacker with administrative privileges to execute arbitrary commands on the underlying operating system of the affected device. The issue arises from inadequate input validation of command arguments provided by users. Exploitation of this vulnerability could enable an attacker to execute commands with root-level privileges.

Impact

Successful exploitation allows for arbitrary command execution on the affected device's operating system with root-level privileges.

Remediation

Cisco has released software updates to address this vulnerability. Users are advised to upgrade to the fixed releases mentioned in the advisory. For guidance on obtaining the updated software, refer to the Cisco Support and Downloads page or contact the Cisco Technical Assistance Center (TAC).