Cisco UCS Manager Software Stored Cross-Site Scripting Vulnerability
TL;DR 📌
- A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit…
- Highest CVSS: 5.4 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20296.
What it is
CVE-2025-20296 is a stored cross-site scripting vulnerability in the web-based management interface of Cisco UCS Manager Software. It sits in the fabric interconnect management plane rather than in any data-forwarding path.
The flaw is caused by insufficient validation of user-supplied input on specific pages of the UCS Manager web interface. To exploit it, an attacker needs to be authenticated with the Administrator or AAA Administrator role, and injects malicious data that is later rendered to another user of the interface. This makes it an authenticated, remote issue rather than something reachable by an anonymous network attacker.
A successful exploit lets the attacker run arbitrary script in the context of the UCS Manager interface, or read sensitive browser-based information (such as session data) belonging to whoever views the affected page. The impact is confined to the web UI session; the CVSS vector reflects low confidentiality and integrity impact with no availability impact, and a scope change (S:C) because the injected script executes in the browser context of another user.
The affected products are UCS 6300, 6400 and 6500 Series Fabric Interconnects, and the UCS X-Series Direct Fabric Interconnect 9108 100G, when running Cisco UCS Manager Software, regardless of configuration. Cisco has confirmed that Firepower, Secure Firewall, MDS 9000, and various Nexus platforms are not affected.
What to do
- Upgrade UCS Manager Software on affected fabric interconnects: releases in the 4.2 train should move to 4.2(3p); releases in the 4.3 train should move to 4.3(6a). Devices on 4.1 or earlier need to migrate to a fixed release. Release 6.0 is not vulnerable.
- There is no workaround, so patching is the only mitigation.
- Since exploitation requires Administrator or AAA Administrator privileges, review who holds these roles and tighten role assignment where broader access than necessary has been granted, as a compensating control until upgrades are complete.
- Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability at time of publication.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 4.2 | 4.2(3p) |
| 4.3 | 4.3(6a) |
For leadership 🧭
Executive summary. Fabric interconnects running UCS Manager (6300/6400/6500 Series and the X-Series 9108 100G) can have malicious script planted in the management UI by a privileged user, exposing another administrator’s session data when they view the affected page. There is no workaround, so scheduling the upgrade is the only fix, though the medium severity and lack of known exploitation mean it can go through a normal patch cycle rather than an emergency one.
Why it matters:
- Exploitation requires Administrator or AAA Administrator access, so this is primarily an insider or compromised-admin-account risk rather than something an outside attacker can trigger directly.
- A successful attack runs script in the UCS Manager web UI and can expose browser-based session information belonging to another privileged user viewing the same interface.
- This sits in the fabric interconnect management plane, not the data-forwarding path, so exploitation affects administrative sessions rather than switching or compute traffic.
- No workaround exists, so any affected UCS 6300/6400/6500 Series or X-Series 9108 100G fabric interconnect stays exposed until the software is upgraded.
Now / Next / Later:
- Now: Identify every UCS 6300, 6400, 6500 Series, or X-Series 9108 100G fabric interconnect running UCS Manager Software and check its current release against 4.2(3p) and 4.3(6a).
- Next: Schedule an upgrade of any device on 4.1 or earlier, or on a 4.2/4.3 release prior to the fixed versions, to 4.2(3p) or 4.3(6a) as appropriate; 6.0 is already unaffected.
- Later: Review and tighten who holds Administrator and AAA Administrator roles on UCS Manager, since this and similar stored XSS issues rely on that privilege level to inject content that other admins will view.