PT-2019-5341

Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected devices, which may allow a remote attacker to...

PT-2019-5342

Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected software, which may allow a remote attacker to...

PT-2019-5337

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

PT-2019-5336

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

Cisco UCS Director SCP User Default Credentials (cisco-sa-20190821-imcs-usercred)

According to its self-reported version, the remote host is running a version of Cisco UCS Director that uses default credentials for the 'scpuser' account. A remote attacker can exploit this to log into the system's CLI and execute arbitrary commands with the privileges of the 'scpuser' account,...

Cisco UCS Director Loggoff DoS (cisco-sa-20190821-ucs-imc-dos)

According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by a denial of service vulnerability. An unauthenticated, remote attacker can exploit this to cause all currently authenticated users to be logged off. C Tenable Network Security,...

Cisco UCS Director Authentication Bypass (cisco-sa-20190821-imcs-ucs-cmdinj)

According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by a command execution vulnerability. An authenticated, remote attacker can exploit this to execute arbitrary commands as a root user. C Tenable Network Security, Inc...

Cisco IMC Supervisor and Cisco UCS Director Command Injection (CVE-2019-1936)

A command injection vulnerability exists in Cisco IMC Supervisor and Cisco UCS Director. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary commands in the affected system...

Cisco UCS Director Web Interface Authentication Bypass (CVE-2019-1937)

An authentication bypass vulnerability exists in Cisco UCS Director web interface. Successful exploitation of this vulnerability could allow a remote attacker to bypass login authentication and gain unauthorized access to the vulnerable system...

Cisco UCS Director authentication bypass and command injection

Added: 09/13/2019 CVE: CVE-2019-1937 Background Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS. Problem An authentication bypass vulnerability in the ClientServlet allows unauthenticated users to gain an administrative session. Furthermore, a...

Cisco UCS Director authentication bypass and command injection

Added: 09/13/2019 CVE: CVE-2019-1937 Background Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS. Problem An authentication bypass vulnerability in the ClientServlet allows unauthenticated users to gain an administrative session. Furthermore, a...

Cisco UCS Director authentication bypass and command injection

Added: 09/13/2019 CVE: CVE-2019-1937 Background Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS. Problem An authentication bypass vulnerability in the ClientServlet allows unauthenticated users to gain an administrative session. Furthermore, a...

Cisco UCS Director - default scpuser password (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule "Cisco UCS Director default scpuser password", 'Description' = %q This module abuses a known...

Cisco UCS Director Default scpuser Password

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule "Cisco UCS Director default scpuser password", 'Description' = %q This module abuses a known...

Cisco UCS Director Unauthenticated Remote Code Execution Exploit

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one,...

Cisco UCS Director Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco UCS Director Unauthenticated Remote Code Execution', 'Description' = %q The Cisco UCS Director virtual appliance contains two flaws that ca...

Cisco UCS Director Default scpuser Password Exploit

This Metasploit module abuses a known default password on Cisco UCS Director. The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH. This module has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also...

The vulnerability in the web interface for managing physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data allows a attacker to bypass authentication procedures and execute arbitrary code.

The vulnerability in the web-based interfaces for managing physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass...

Cisco UCS Director, Cisco Integrated Management Controller Supervisor - Multiple Vulnerabilities

Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data Discovered by Pedro Ribeiro email protected from Agile Information Security ================================================================...

Cisco UCS / IMC Supervisor Authentication Bypass / Command Injection

Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data Discovered by Pedro Ribeiro [email protected] from Agile Information Security...