CVE-2021-1592: cisco cisco unified computing system (managed)

Vulnerability summary

CVE-2021-1592 is a medium (CVSS 4.3) vulnerability in cisco cisco unified computing system (managed). EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.1% of scored vulnerabilities.

Timeline

1. 25-08-2021
   PublishedVulnerability first disclosed.
2. 07-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management for established SSH sessions. An attacker could exploit this vulnerability by opening a significant number of SSH sessions on an affected device. A successful exploit could allow the attacker to cause a crash and restart of internal Cisco UCS Manager software processes and a temporary loss of access to the Cisco UCS Manager CLI and web UI. Note: The attacker must have valid user credentials to authenticate to the affected device.

• CWE-664Improper Control of a Resource Through its LifetimeThe product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.