Hardcoded credentials

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

Code injection

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4079

CVE-2012-4079 affects Cisco UCS Fabric Interconnect: the XML API service can be brought down by a remote, unauthenticated attacker sending a malformed XML packet. Root cause is improper input validation in the XML API service. Impact is a DoS (API service outage). Cisco’s advisory notes that soft...

CVE-2012-4092

CVE-2012-4092 affects Cisco UCS Central Software’s management interface, where improper validation of vCenter console identities enables MITM-style interception—read/modify inter-device data streams. Root cause: identity spoofing between vCenter consoles and UCS Manager. Impact is partial confide...

CVE-2012-4092

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4088

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

CVE-2012-4086

CVE-2012-4086 affects Cisco Unified Computing System (UCS) fabric interconnect devices. The issue resides in the initial setup script, where unfiltered input during configuration can be exploited by an unauthenticated, remote attacker to execute arbitrary commands on the underlying OS with the da...

CVE-2012-4085

The Intelligent Platform Management Interface IPMI implementation in the Blade Management Controller in Cisco Unified Computing System UCS allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761...

CVE-2012-4089

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

CVE-2012-4078

The Baseboard Management Controller BMC in Cisco Unified Computing System UCS does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656...

CVE-2012-4094

Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198...

Authentication flaw

The Baseboard Management Controller BMC in Cisco Unified Computing System UCS does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656...

Command injection

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

Buffer overflow

Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198...

Command injection

A cluster setup script for fabric interconnect devices in Cisco Unified Computing System UCS allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793...

Design/Logic Flaw

The Intelligent Platform Management Interface IPMI implementation in the Blade Management Controller in Cisco Unified Computing System UCS allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761...

CVE-2012-4087

Cisco UCS Fabric Interconnect devices contain a vulnerability in the cluster initial setup script that allows an unauthenticated, remote attacker to execute arbitrary commands via invalid parameters. The root cause is unfiltered input during the initial configuration phase, restricting exploitati...

CVE-2012-4087

A cluster setup script for fabric interconnect devices in Cisco Unified Computing System UCS allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793...

CVE-2012-4078

The Cisco UCS Baseboard Management Controller (BMC) is affected by a vulnerability due to improper filtering of SSH escape sequences, allowing an authenticated, remote attacker to bypass part of the authentication via SSH port forwarding and access services with elevated privileges. The issue (Bu...

CVE-2012-4089

The CVE-2012-4089 issue affects Cisco Unified Computing System fabric interconnects (FI) via its MCTOOLS command. The root cause is improper input validation in MCTOOLS, enabling an authenticated, local attacker with local/shell-level/debug-level OS access to inject commands and execute arbitrary...