Command Injection in Cisco UCS Manager Software
CVE-2025-20294

6.5MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Unified Computing System (managed)
Vendor
CVE Published:
27 August 2025

Badges

👾 Exploit Exists

What is CVE-2025-20294?

Multiple vulnerabilities exist in the CLI and web-based management interface of Cisco UCS Manager Software, allowing authenticated remote attackers with administrative privileges to execute command injection attacks. These vulnerabilities stem from inadequate input validation of command arguments provided by the user. By authenticating to a device and submitting specially crafted input to the affected commands, an attacker could exploit these issues to gain root-level access and execute arbitrary commands on the device's operating system. This poses a serious risk to the integrity and security of the affected system.

Affected Version(s)

Cisco Unified Computing System (Managed) 4.0(1a)

Cisco Unified Computing System (Managed) 4.1(1d)

Cisco Unified Computing System (Managed) 4.0(4f)

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20294 : Command Injection in Cisco UCS Manager Software