TI-2020-02881 Aliases CVE-2020-3329 GHSA-r92q-j6h7-wh5j

Improper access control in Cisco UCS Director

LOW 21CWE-284Published 2020-05-06 · Updated 2024-11-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00675 52nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco UCS Director	all versions	—	No fix listed	CNA

Cisco UCS Director VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:integrated_management_controller_supervisor::::::::	1.1.0.0 to before 2.2.1.3	Vulnerable	Cisco
cpe:2.3:a:cisco:ucs_director::::::::	5.4.0.0 to before 6.7.4.0	Vulnerable	Cisco
cpe:2.3:a:cisco:ucs_director_express_for_big_data::::::::	2.0.0.0 to before 3.7.4.0	Vulnerable	Cisco

cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:* Versions 1.1.0.0 to before 2.2.1.3 Vulnerable ·Cisco
cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:* Versions 5.4.0.0 to before 6.7.4.0 Vulnerable ·Cisco
cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:* Versions 2.0.0.0 to before 3.7.4.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-3329
2026-10-03 Alias added: GHSA-r92q-j6h7-wh5j

References

Advisory 1

20200506 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability

TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
TI-2019-01555 Hard-coded credentials in Cisco Unified Computing System Director CVSS 3.1CRITICAL 9.8
TI-2019-01557 Improper authentication in Cisco Unified Computing System Director CVSS 3.0CRITICAL 9.8
TI-2019-01556 Improper input validation in Cisco Unified Computing System Director CVSS 3.1HIGH 7.2
TI-2019-01594 Improper authentication in Cisco Unified Computing System Director CVSS 3.0CRITICAL 9.8
TI-2019-01487 Cisco Integrated Management Controller Command Injection Vulnerability CVSS 3.1HIGH 8.8

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences