Cisco UCS Manager Software Flaw Allows Attackers to Inject Malicious Commands

Cisco has released urgent security updates to fix two medium-severity command injection vulnerabilities in its UCS Manager Software, which could allow an authenticated administrator to execute arbitrary commands and compromise system integrity. The advisory, disclosed on 27 August 2025 and identified as cisco-sa-ucs-multi-cmdinj-E4Ukjyrz, covers multiple UCS fabric interconnect platforms and underscores the importance of timely patching.

The vulnerabilities, CVE-2025-20294 and CVE-2025-20295, stem from insufficient input validation of user-supplied command arguments, with CVE-2025-20294 affecting both the CLI and the web-based management portal and CVE-2025-20295 confined to the CLI environment. An authenticated local administrator could read, create, or overwrite arbitrary OS files, including critical system binaries and configuration files, and there is potential for root privileges and lateral movement within the UCS domain.

Affected hardware includes Cisco UCS 6300, 6400, and 6500 Series Fabric Interconnects, as well as the UCS X-Series Direct Fabric Interconnect 9108 100G, running UCS Manager Software versions 4.1 and earlier and 6.0 in some configurations, with upgrades required according to Cisco’s release notes. No workarounds exist, and upgrading to a fixed UCS Manager Software release is the recommended remediation, as noted by Cisco PSIRT.