UCS Central security threat

[Walter Dey]

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0701

Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.

Can someone from TAC confirm, if this is fixed in 1.3.1a; according to the bug Report (see below), it's not.

Cisco Bug: CSCut46961 - Cisco UCS Central Software Arbitrary Command Execution VulnerabilitLast Modified

May 06, 2015

Product

Cisco UCS Central Software

Known Affected Releases

1.2(1d)

[jvanewyk · Accepted solution]

As per the NIST report, this applies to UCS Central versions before 1.3(1a). According to the Cisco Bug ID CSCut46961, it was fixed in UCS Central 1.3(1a), consistent with the NIST statement as well.

Cheers,

Jacob Van Ewyk

UCS Management product manager