Improper restriction of communication channel to intended endpoints in Cisco Systems, Inc products - CVE-2025-20261
Published: June 6, 2025
Vulnerability identifier: #VU110234
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-20261
CWE-ID: CWE-923
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient restrictions on access to internal services in the SSH connection handling. A remote user can use specially crafted syntax and access internal services with elevated privileges.
Affected software
UCS B-Series Blade Servers
UCS S-Series Storage Servers
UCS X-Series Modular System
UCS C-Series Rack Servers
Cisco Integrated Management Controller
Cisco Intersight Server
Cisco Unified Computing System (UCS)
UCS S-Series Storage Servers
UCS X-Series Modular System
UCS C-Series Rack Servers
Cisco Integrated Management Controller
Cisco Intersight Server
Cisco Unified Computing System (UCS)
How to mitigate CVE-2025-20261
Install updates from vendor's website.
Cisco Intersight Server - addressed in versions 4.2(3i), 5.0(4f), 5.2(2.240073)
Cisco Unified Computing System (UCS) - addressed in versions 4.1(3n), 4.2.2c, 4.2.3b, 4.3(4c)
Cisco Integrated Management Controller - update to 4.2(2f)
Cisco Unified Computing System (UCS) - addressed in versions 4.1(3n), 4.2.2c, 4.2.3b, 4.3(4c)
Cisco Integrated Management Controller - update to 4.2(2f)