PT-2020-3774 · Cisco · Cisco Ucs 6400 Series Fabric Interconnects+1

Published 2020-08-26 · Updated 2023-04-20 · CVE-2020-3504

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Cisco UCS 6400 Series Fabric Interconnects (affected versions not specified) Cisco UCS Manager Software (affected versions not specified)

Description: The issue is related to the improper handling of CLI command parameters in the local management component of the software. This could allow an authenticated, local attacker to cause a denial of service condition on an affected device. An attacker could exploit this by executing specific commands on the local-mgmt CLI, potentially causing internal system processes to fail to terminate properly. This could lead to a buildup of stuck processes, resulting in slowness when accessing the UCS Manager CLI and web UI. A sustained attack may cause a restart of internal UCS Manager processes and a temporary loss of access to the UCS Manager CLI and web UI.

Recommendations: For Cisco UCS 6400 Series Fabric Interconnects, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco UCS Manager Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-664

CWE-400

Related Identifiers

BDU:2020-04134

CVE-2020-3504

Affected Products

Cisco Ucs 6400 Series Fabric Interconnects

Cisco Ucs Manager

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-cli-dos-GQUxCnTe · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04134 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3504 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3504 · Vendor Advisory