CVE-2015-4259 — Cisco Unified Computing System vulnerability

CWE-3104 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 66.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Computing System
Timeline
PublishedJul 10
Latest updateMay 17

Description

The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug IDs CSCum56133 and CSCum56177.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDcisco/unified_computing_system1.5\(3\), 1.6\(0.16\)+1

🔴Vulnerability Details

2
GHSA
GHSA-cq2w-9r84-5hfm: The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1↗2022-05-17
▶
CVEList
CVE-2015-4259: The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1↗2015-07-10
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Computing System C-Series Servers Man-in-the-Middle Vulnerability↗2015-07-09
▶
CVE-2015-4259 — Cisco vulnerability | cvebase