Cisco has released software updates to patch a remotely exploitable vulnerability affecting the company’s UCS Director and Integrated Management Controller (IMC) Supervisor products.
Cisco UCS Director, a unified infrastructure management solution, and Cisco IMC Supervisor, a centralized management solution for C-series and E-series servers, are plagued by a flaw (CVE-2015-6259) that allows a remote, unauthenticated attacker to overwrite arbitrary files by sending specially crafted HTTP requests to the affected system. This can result in system instability or a denial-of-service (DoS) condition.
The vulnerability, found in JavaServer Pages (JSP) input validation routines, is caused by improper input sanitization on certain JSP pages, Cisco explained in an advisory.
Cisco IMC Supervisor running software versions prior to 1.0.0.1, and Cisco UCS Director running software versions prior to 5.2.0.1 are affected by the vulnerability.
The security hole has been assigned a CVSS score of 7.8, which puts it in the high severity category.
Cisco says the flaw has been discovered by its own security team, and there is no evidence that it has been exploited in the wild. Users are advised to apply the software updates released by Cisco to prevent potential incidents. The company has pointed out that no workaround is available.
Related Reading: Default SSH Keys Expose Cisco’s Virtual Security Appliances
Related Reading: Cisco Patches DoS Vulnerability in ASR Routers
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
Latest News
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Amazon Settles Ring Customer Spying Complaint
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
