CVE-2020-3504: cisco cisco unified computing system (managed)

Vulnerability summary

CVE-2020-3504 is a low (CVSS 3.3) vulnerability in cisco cisco unified computing system (managed). EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.6% of scored vulnerabilities.

Timeline

1. 27-08-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI command parameters. An attacker could exploit this vulnerability by executing specific commands on the local-mgmt CLI on an affected device. A successful exploit could allow the attacker to cause internal system processes to fail to terminate properly, which could result in a buildup of stuck processes and lead to slowness in accessing the UCS Manager CLI and web UI. A sustained attack may result in a restart of internal UCS Manager processes and a temporary loss of access to the UCS Manager CLI and web UI.

• CWE-664Improper Control of a Resource Through its LifetimeThe product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.