Cisco Ucs Central Software vulnerabilities

5 CVEs affecting Cisco Ucs Central Software, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-20280, published 2024-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2023-20012, published 2023-02-23. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker…
CVE-2023-20015, published 2023-02-23. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects could allow an authenticated,…
CVE-2024-20280, published 2024-10-16. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and…
CVE-2023-20016, published 2023-02-23. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to…