CVE-2021-1354 Cisco Unified Computing System Central Software Improper Certificate Validation Vulnerability

What is CVE-2021-1354?

CVE-2021-1354 is a medium-severity vulnerability in Cisco Unified Computing System Central Software, published on 4 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.

Weakness: CWE-295

Which versions are affected by CVE-2021-1354?

It affects 1 product.

Products include Cisco Unified Computing System Central Software.

How do I fix CVE-2021-1354?

No fix has been published for CVE-2021-1354 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-1354 being exploited?

There is no known exploitation of CVE-2021-1354 in the wild and no public exploit code.

Other vulnerabilities in Cisco Unified Computing System Central Software

• CVE-2015-0701 Command injection in n/a Critical 10.0
• CVE-2016-1352 Command injection in n/a Critical 9.8
• CVE-2018-0113 Command injection in Cisco UCS Central High 8.8
• CVE-2018-0094 Denial of service in Cisco UCS Central Software High 7.5
• CVE-2014-0730 Privilege escalation in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-grv9-44cv-g58h.