4.4

CVE-2026-20037

A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system.
 
This vulnerability exists because unnecessary privileges are given to the user. An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI. A successful exploit could allow the attacker to create or overwrite files in the file system or perform limited privileged actions on an affected device.   
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco Unified Computing System (Managed)
Default Statusunknown
Version 4.0(4c)
Status affected
Version 4.0(2b)
Status affected
Version 4.1(2a)
Status affected
Version 4.0(1a)
Status affected
Version 4.0(2a)
Status affected
Version 4.0(1b)
Status affected
Version 4.1(1c)
Status affected
Version 4.0(4a)
Status affected
Version 4.0(4b)
Status affected
Version 4.0(2e)
Status affected
Version 4.1(1a)
Status affected
Version 4.0(4d)
Status affected
Version 4.0(4h)
Status affected
Version 4.0(4g)
Status affected
Version 4.0(1d)
Status affected
Version 4.1(1e)
Status affected
Version 4.0(4f)
Status affected
Version 4.0(4e)
Status affected
Version 4.0(4i)
Status affected
Version 4.1(1d)
Status affected
Version 4.0(2d)
Status affected
Version 4.1(1b)
Status affected
Version 4.0(1c)
Status affected
Version 4.1(2b)
Status affected
Version 4.0(4k)
Status affected
Version 4.1(3a)
Status affected
Version 4.1(3b)
Status affected
Version 4.1(2c)
Status affected
Version 4.0(4l)
Status affected
Version 4.1(4a)
Status affected
Version 4.1(3c)
Status affected
Version 4.1(3d)
Status affected
Version 4.2(1c)
Status affected
Version 4.2(1d)
Status affected
Version 4.0(4m)
Status affected
Version 4.1(3e)
Status affected
Version 4.2(1f)
Status affected
Version 4.1(3f)
Status affected
Version 4.2(1i)
Status affected
Version 4.1(3h)
Status affected
Version 4.2(1k)
Status affected
Version 4.2(1l)
Status affected
Version 4.0(4n)
Status affected
Version 4.2(1m)
Status affected
Version 4.1(3i)
Status affected
Version 4.2(2a)
Status affected
Version 4.2(1n)
Status affected
Version 4.1(3j)
Status affected
Version 4.2(2c)
Status affected
Version 4.2(2d)
Status affected
Version 4.2(3b)
Status affected
Version 4.1(3k)
Status affected
Version 4.0(4o)
Status affected
Version 4.2(2e)
Status affected
Version 4.2(3d)
Status affected
Version 4.2(3e)
Status affected
Version 4.2(3g)
Status affected
Version 4.1(3l)
Status affected
Version 4.3(2b)
Status affected
Version 4.2(3h)
Status affected
Version 4.2(3i)
Status affected
Version 4.3(2c)
Status affected
Version 4.1(3m)
Status affected
Version 4.3(2e)
Status affected
Version 4.3(3a)
Status affected
Version 4.2(3j)
Status affected
Version 4.3(3c)
Status affected
Version 4.3(4a)
Status affected
Version 4.2(3k)
Status affected
Version 4.3(4b)
Status affected
Version 4.3(4c)
Status affected
Version 4.2(3l)
Status affected
Version 4.3(4d)
Status affected
Version 4.3(2f)
Status affected
Version 4.2(3m)
Status affected
Version 4.3(5a)
Status affected
Version 4.3(4e)
Status affected
Version 4.1(3n)
Status affected
Version 4.3(4f)
Status affected
Version 4.2(3n)
Status affected
Version 4.3(5c)
Status affected
Version 4.2(3o)
Status affected
Version 4.3(5d)
Status affected
Version 4.3(6a)
Status affected
Version 4.3(6b)
Status affected
Version 4.3(5e)
Status affected
Version 4.3(6c)
Status affected
Version 4.2(3p)
Status affected
Version 4.3(6d)
Status affected
Version 4.3(6e)
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.032
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 4.4 1.8 2.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.