PT-2024-7336 · Cisco · Cisco Ucs Central

Published 2024-10-16 · Updated 2024-10-31 · CVE-2024-20280

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco UCS Central Software (affected versions not specified)

Description: A weakness in the encryption method used for the backup function in Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information. This information includes local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key. The vulnerability is due to the use of a static key for the backup configuration feature, which an attacker could exploit by accessing a backup file.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2024-08692

CVE-2024-20280

Affected Products

Cisco Ucs Central

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsky-TgJ5f73J · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08692 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20280 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20280 · Vendor Advisory
• https://twitter.com/CVEnew/status/1846609979861881067 · Twitter Post
• https://t.me/cvenotify/98745 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846762404677370235 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024101726 · Note