CVE-2024-20280: Cisco UCS Central Software Configuration Backup Static Key Vulnerability
First published: Wed Oct 16 2024(Updated: )
A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco UCS Central |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20280?
CVE-2024-20280 is classified as a high-severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2024-20280?
To mitigate CVE-2024-20280, update to the latest version of Cisco UCS Central Software that addresses this vulnerability.
What does CVE-2024-20280 affect?
CVE-2024-20280 affects the backup feature of Cisco UCS Central Software.
What information can be exposed by CVE-2024-20280?
CVE-2024-20280 can expose sensitive information stored in the full state and configuration backup files.
Is CVE-2024-20280 being actively exploited?
As of the latest information available, there are no reports indicating that CVE-2024-20280 is being actively exploited in the wild.
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ucs central