Cisco UCS Central Software Faces Remote Code Execution Vulnerability
Original title: Cisco UCS Central Software Remote Code Execution Vulnerability
Insufficient input validation in UCS Central Software HTTP requests allows authenticated remote code execution and information disclosure.
A vulnerability in Cisco UCS Central Software allows an authenticated remote attacker to achieve remote code execution or information disclosure. It stems from insufficient validation of user-supplied input in HTTP requests. An attacker must have valid credentials to exploit it. Successful exploitation could enable arbitrary command execution, file writes, and sensitive data access.
- Affects Cisco UCS Central Software
- Requires valid user credentials
- Enables arbitrary command execution
- Allows file system writes and information disclosure
Impact: Authenticated remote code execution and information disclosure
- 1.Upgrade to patched Cisco UCS Central Software version
- 2.Revoke credentials for affected devices
- 3.Monitor network traffic for suspicious requests
- Vendors
- Cisco
- Products
- UCS Central Software
From the original article
A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.