PT-2021-4502 · Cisco · Cisco Ucs Manager

Art Kalmykov · Published 2021-08-25 · Updated 2021-09-25 · CVE-2021-1592

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco UCS Manager software (affected versions not specified)

Description A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to improper resource management for established SSH sessions. An attacker could exploit this by opening a significant number of SSH sessions, potentially causing a crash and restart of internal software processes and a temporary loss of access to the Cisco UCS Manager CLI and web UI. The attacker must have valid user credentials to authenticate to the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-664

Related Identifiers

BDU:2021-05138

CVE-2021-1592

Affected Products

Cisco Ucs Manager

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-ssh-dos-MgvmyrQy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1592 · Security Note
• https://bdu.fstec.ru/vul/2021-05138 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1592 · Vendor Advisory
• https://t.me/cvenotify/20631 · Telegram Post
• https://t.me/cvenotify/20099 · Telegram Post