Input Validation Flaw in Cisco UCS Manager Software Allows File Manipulation
CVE-2025-20295
What is CVE-2025-20295?
A significant security flaw exists in the Command Line Interface (CLI) of Cisco UCS Manager Software, which may allow authenticated local attackers with administrative privileges to exploit this vulnerability. The issue originates from inadequate input validation of user-supplied command arguments, enabling attackers to submit specially crafted inputs. Upon successful exploitation, these individuals could read, create, or overwrite files on the underlying operating system's file system, including critical system files, potentially jeopardizing the integrity and availability of affected devices. To successfully carry out this attack, the intruder must possess valid administrative credentials.
Affected Version(s)
Cisco Unified Computing System (Managed) 4.0(1a)
Cisco Unified Computing System (Managed) 4.1(1d)
Cisco Unified Computing System (Managed) 4.0(4f)