CVE-2020-3243: cisco cisco ucs director Improper Input Validation
Vulnerability summary
CVE-2020-3243 is a critical (CVSS 9.8) Improper Input Validation vulnerability in cisco cisco ucs director. EPSS estimates a 88.37% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 15-04-2020PublishedVulnerability first disclosed.
- 15-11-2024Last modifiedVulnerability information updated.
Description
Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
88.37%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 88.37% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCisco UCS Director Cloupia Script RCE
exploit/linux/http/cisco_ucs_cloupia_script_rce
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Cisco3 products
- cisco ucs directorn/a
- ucs_director6.0.0.0 | 6.0.0.1 | 6.0.1.0 | 6.0.1.1 | 6.0.1.2 | 6.0.1.3 | 6.5.0.0 | 6.5.0.1 | 6.5.0.2 | 6.5.0.3 | 6.5.0.4 | 6.6.0.0 | 6.6.1.0 | 6.6.2.0 | 6.7.0.0 | 6.7.1.0 | 6.7\(2.0\) | 6.7.3.0
- ucs_director_express_for_big_data≤ 3.7.3.0
1 vendor · 3 products
References
3 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-mult-vulns-UNfpdW4EVendor AdvisoryX Refsource CISCO