Cisco UCS Central Software RCE (cisco-sa-cucs-rce-LzHSFRDQ)

#TRUSTED 9a2a4497bfa4a63424724876466eb23dc8f382837ea28c66485b791abd973fa424100890136128a893601d638659f79b1aaa72bf78fd788a0d44cbe78b30e8cbe810ca2c91d782d30201ff5dbc23ee4d14f3087266017ee8682bb12449c4a8a852602fa47762de5ce2fd1f00a4268ac13080021601418cc54a7269ffb6d316bcc4dc0ce0cb65f22ea96576cdd570d7d4191af48620ebc703f7dd78c8e4377965e731a219140b86654231635630855037acc50842d01a5b7dfaa725547f55afdf69377dce8493b0d56a98673065a4f65b5cc905f46363badce7f4b02d7c75f944fb7b873dfcc7cb1e3d627872dd2a57f9fcfa4d16a2e42235c583939a00d12067da0d5240a6c6c8ee8c166c7c65c2bb0a1a005b2f1b2d30522653b73e8f4d8d851e0fbfd5525c39ccc2e93ef583101f92663a542f52bbbffc263a9ae4a55896f6e6717d1c790acf99de2c445ff07f42cdc87ab61d5df7b93895a3df6781761761ad6ab825a89d28ee16b9bc22b1ffd389f9106f5e9554feee3b041fcccfd9fdb4c150fdb42e8e65c6cebd0b22b3c0935363989dfaed68dd7f86edad7a40dbbae4a314759fd80b4e323f0ca509ae8c780262e3ed190ad8395ca5f68ba5b8f7b0f8df652b0d2233ed212266b63f37fe05080998b179f3d9ce073ea56b0d8a2187b7ee8ebf105d4fa82ea3b3d4ba0d121df42a8299e6ebd2c2fa0ccabca25421cee9
#TRUST-RSA-SHA256 7db24e9fdcc9181ef535f079f4558081d2c8eb3612c65f0eb2ec8b1cce52788ed2f2b97e3468ae0b8f22f4f3adb938fd92f60ad9ba0968516ba147673bfba471e738c01d75da048a315ac3453946be73ad6457e7a4e9c7066837c451da98344e51401e6f0fd62076e4d2f1c7fca1efb2ec0985e796d877e2b8302f0bbcf77e0c355e9c61311069c5ed94fb822cd616b45e98b53122e99064f761f046ff1d02859ca092baea1d6e3fd11ad8fe19cdb25045ee81396781775d88076a09efda4f139cf3514cd059d581503c7ed2a5f67d7f215d1330ea2a27d677d48d6b8923b4a898355dd8c03086e4fefbc999aed6d68ad7e56e81dbddb8204e0e6764a32719b66fe306bd5893170e0e1a09481c37a910a5acd860e1ee6fd604c8c30f41f23e274c8c3a7af224355e2a4e1ef280bef8901decde0e8a55804b16c056409ca98d39a9752ab8a5094ec3bffc2e6b99a33e87f83c7a6b971ad31102b8672ab124fe7913989fdbc3ec30ef6bc8f41348376820653ab20ba7ad2989be0ec572fb80815188a41862cbc38ffd302aad7fa8cdcb645d76b77a5e465e409f536da6c8f50bb29a6cea93e1ad3a422d6834a926adc2470e2643c0083bf389c196764ddee1370c1b34c59b7244593c2f3cc269c53510a3650f54509af5a079f383b3ed9a2f48ce8726cd7aee9dbdc636613ac0bcb6bade1b8fe62d0ab17d57203362e4624f483c
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(377047);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/06");

  script_cve_id("CVE-2026-76506");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv60193");
  script_xref(name:"CISCO-SA", value:"cisco-sa-cucs-rce-LzHSFRDQ");
  script_xref(name:"IAVA", value:"2026-A-1247");

  script_name(english:"Cisco UCS Central Software RCE (cisco-sa-cucs-rce-LzHSFRDQ)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Unified Computing System Central Software is affected by a vulnerability.

  - A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an
    authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks
    on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an
    HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an
    affected endpoint on an affected device. A successful exploit could allow the attacker to execute
    arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit
    this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has
    released software updates that address this vulnerability There are no workarounds that address this
    vulnerability. (CVE-2026-76506)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?18aa6efe");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv60193");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwv60193");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76506");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:unified_computing_system_central");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucs_central_webui_detect.nbin");
  script_require_keys("installed_sw/Cisco UCS Central WebUI");

  exit(0);
}

include('ccf.inc');
include('http.inc');

var app_name = 'Cisco UCS Central WebUI';
var port = get_http_port(default:443);

var product_info = cisco::get_product_info(name:app_name, port:port);

# 2.0 and earlier: migrate to a fixed release; 2.1: fixed in 2.1(2c)
var vuln_ranges = [
  {'min_ver' : '0.0', 'fix_ver': '2.1(2c)'}
];

var reporting = make_array(
  'port'          , port,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwv60193',
  'fix'           , '2.1(2c)',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);