Cisco UCS Manager Software Command Injection Vulnerabilities
TL;DR 📌
- Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates…
- Highest CVSS: 6.5 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20295, CVE-2025-20294.
What it is
Cisco’s August 2025 advisory covers two separate command injection flaws in UCS Manager Software, both sitting in the CLI and, for one of them, also the web-based management interface.
CVE-2025-20294 affects the CLI and web UI. It requires an authenticated attacker with administrative privileges, but can be triggered remotely (AV:N). The root cause is insufficient input validation of command arguments — an attacker submits crafted input to affected commands and can execute arbitrary commands on the underlying operating system with root-level privileges.
CVE-2025-20295 is CLI-only and requires local access (AV:L) along with valid administrative credentials. Rather than arbitrary command execution, the impact here is file read, creation, or overwrite on the underlying OS filesystem, including system files — again due to insufficient validation of command arguments.
In both cases, exploitation depends on the attacker already holding administrative credentials on the device; there is no unauthenticated path described. The vulnerabilities are independent of each other — a device affected by one is not necessarily affected by the other. Affected hardware is UCS 6300, 6400 and 6500 Series Fabric Interconnects, and the UCS X-Series Direct Fabric Interconnect 9108 100G, when running UCS Manager Software, regardless of configuration.
What to do
- Upgrade UCS Manager Software: releases in the 4.2 train should move to 4.2(3p); releases in the 4.3 train should move to 4.3(6c). Devices on 4.1 or earlier should migrate to a fixed release train. UCS Software 6.0 is not vulnerable.
- There are no workarounds — patching is the only mitigation Cisco offers for either CVE.
- Since both flaws require existing administrative credentials, tighten control over who holds admin access to UCS Manager and review credential hygiene for those accounts as a compensating measure while patching is scheduled.
- Confirm which Fabric Interconnect model and current software release you’re running against the fixed-release table before upgrading, and check hardware/software compatibility as usual before applying the update.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 4.2 | 4.2(3p) |
| 4.3 | 4.3(6c) |
For leadership 🧭
Executive summary. Admin-level users on Cisco UCS Fabric Interconnects can exploit weak input validation in UCS Manager’s CLI and web interface to gain root or manipulate system files, undermining the trust boundary between UCS admins and the underlying OS. There’s no workaround, so this needs scheduling into the next patch window rather than urgent emergency action, but exposure lasts as long as unpatched devices remain in service.
Why it matters:
- CVE-2025-20294 is reachable remotely (AV:N) through the CLI or web UI, meaning any authenticated admin session — not just console access — can be used to escalate to root on the Fabric Interconnect’s OS.
- CVE-2025-20295 lets a locally-authenticated admin read, create or overwrite arbitrary files including system files, which could be used to plant persistence or corrupt configuration on the interconnect.
- Affected hardware includes UCS 6300, 6400 and 6500 Series Fabric Interconnects and the X-Series 9108 100G, which sit at the heart of UCS blade and rack server fabric — compromise here affects everything managed through that UCS domain.
- There are no workarounds for either flaw, so any UCS Manager instance on 4.1 or earlier, or pre-fix 4.2/4.3 builds, stays exposed until upgraded.
Now / Next / Later:
- Now: Identify every UCS Fabric Interconnect and its current UCS Manager release version against the fixed-release table, and review who currently holds administrative credentials on those devices.
- Next: Upgrade 4.2-train devices to 4.2(3p) and 4.3-train devices to 4.3(6c) in the next change window; devices still on 4.1 or earlier should be migrated to a fixed release train (6.0 is unaffected).
- Later: Tighten and periodically audit administrative access to UCS Manager, since both flaws depend entirely on the attacker already holding admin credentials — reducing standing admin accounts limits the blast radius of any future similar CLI or web-UI flaw.