CVE-2025-20294

{"id": "CVE-2025-20294", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2025-08-27T17:15:35.540", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-multi-cmdinj-E4Ukjyrz", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root.\r\n \r\nThese vulnerabilities are due to insufficient input validation of command arguments supplied by the user. An attacker could exploit these vulnerabilities by authenticating to a device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges."}, {"lang": "es", "value": "Varias vulnerabilidades en la CLI y la interfaz de administraci\u00f3n web del software Cisco UCS Manager podr\u00edan permitir que un atacante remoto autenticado con privilegios administrativos realice ataques de inyecci\u00f3n de comandos en un sistema afectado y ascienda a privilegios de root. Estas vulnerabilidades se deben a una validaci\u00f3n insuficiente de los argumentos de los comandos proporcionados por el usuario. Un atacante podr\u00eda explotar estas vulnerabilidades autentic\u00e1ndose en un dispositivo y enviando una entrada manipulada a los comandos afectados. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar comandos arbitrarios en el sistema operativo subyacente del dispositivo afectado con privilegios de root."}], "lastModified": "2025-08-29T16:24:09.860", "sourceIdentifier": "psirt@cisco.com"}