Vulnerability in Cisco Unified Computing System

CVE-2015-4259

The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug IDs CSCum56133 and CSCum56177.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.008 (52.1th percentile) — read the EPSS interpretation.

Affected products

Cisco Unified_computing_system — versions 1.5\(3\), 1.6\(0.16\)
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

References

psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)