PT-2025-34891 · Cisco · Cisco Ucs Manager

Published 2025-08-27 · Updated 2025-08-28 · CVE-2025-20294

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Cisco UCS Manager Software (affected versions not specified)

Description: Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. These vulnerabilities are due to insufficient input validation of command arguments supplied by the user. An attacker could exploit these vulnerabilities by authenticating to a device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-12521

CVE-2025-20294

Affected Products

Cisco Ucs Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20294 · Security Note
• https://bdu.fstec.ru/vul/2025-12521 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-multi-cmdinj-E4Ukjyrz · Vendor Advisory
• https://twitter.com/0dayPublishing/status/1960756537363701805 · Twitter Post
• https://twitter.com/CVEnew/status/1960745849870541059 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960875530971959641 · Twitter Post