CVE-2021-1354

Medium

Description

A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Cisco Unified Computing System Central Software

PublishedFeb 4, 2021

First seenFeb 4, 2021

Weakness typeCWE-295CWE-295

How to fix

Update

cisco unified_computing_system_central_software2.0\(1m\) or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-invcert-eOpRvCKH

Affected products

Product	Affected versions	Fixed in
cisco unified_computing_system_central_software	v < 2.0\(1m\)	2.0\(1m\)

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.