Read the docs
TI-2024-13215 Aliases CVE-2024-20280GHSA-jm5c-w4xp-6794

Cisco UCS Central Software Configuration Backup Static Key Vulnerability

Priority LOW 27CWE-321Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00111 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Unified Computing System Central Software2.0(1e); 1.1(1b); 1.4(1b); 2.0(1a); 2.0(1h); 1.3(1a); 2.0(1g); 2.0(1c); 2.0(1k); 1.0(1a); 2.0(1l); 1.2(1f); 2.0(1f); 1.4(1c); 1.3(1c); 1.1(1a); 1.4(1a); 1.2(1a); 1.2(1d); 2.0(1j); 1.5(1c); 1.5(1a); 1.1(2a); 1.3(1b); 2.0(1b); 2.0(1i); 1.2(1e); 1.5(1b); 2.0(1d); 2.0(1m); 2.0(1n); 2.0(1o); 2.0(1p); 2.0(1q); 2.0(1r); 2.0(1s); 2.0(1t); 2.0(1u)—No fix listedCNA
  • Cisco Unified Computing System Central Software VendorCisco Affected 2.0(1e); 1.1(1b); 1.4(1b); 2.0(1a); 2.0(1h); 1.3(1a); 2.0(1g); 2.0(1c); 2.0(1k); 1.0(1a); 2.0(1l); 1.2(1f); 2.0(1f); 1.4(1c); 1.3(1c); 1.1(1a); 1.4(1a); 1.2(1a); 1.2(1d); 2.0(1j); 1.5(1c); 1.5(1a); 1.1(2a); 1.3(1b); 2.0(1b); 2.0(1i); 1.2(1e); 1.5(1b); 2.0(1d); 2.0(1m); 2.0(1n); 2.0(1o); 2.0(1p); 2.0(1q); 2.0(1r); 2.0(1s); 2.0(1t); 2.0(1u) Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:cisco:ucs_central_software:1.0\(1a\):*:*:*:*:*:*:*1.0(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.1\(1a\):*:*:*:*:*:*:*1.1(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.1\(1b\):*:*:*:*:*:*:*1.1(1b)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.1\(2a\):*:*:*:*:*:*:*1.1(2a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.2\(1a\):*:*:*:*:*:*:*1.2(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.2\(1d\):*:*:*:*:*:*:*1.2(1d)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.2\(1e\):*:*:*:*:*:*:*1.2(1e)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.2\(1f\):*:*:*:*:*:*:*1.2(1f)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.3\(1a\):*:*:*:*:*:*:*1.3(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.3\(1b\):*:*:*:*:*:*:*1.3(1b)VulnerableCisco
  • cpe:2.3:a:cisco:ucs_central_software:1.0\(1a\):*:*:*:*:*:*:* Versions 1.0(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.1\(1a\):*:*:*:*:*:*:* Versions 1.1(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.1\(1b\):*:*:*:*:*:*:* Versions 1.1(1b) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.1\(2a\):*:*:*:*:*:*:* Versions 1.1(2a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.2\(1a\):*:*:*:*:*:*:* Versions 1.2(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.2\(1d\):*:*:*:*:*:*:* Versions 1.2(1d) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.2\(1e\):*:*:*:*:*:*:* Versions 1.2(1e) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.2\(1f\):*:*:*:*:*:*:* Versions 1.2(1f) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.3\(1a\):*:*:*:*:*:*:* Versions 1.3(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.3\(1b\):*:*:*:*:*:*:* Versions 1.3(1b) Vulnerable ·Cisco
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:ucs_central_software:1.3\(1c\):*:*:*:*:*:*:*1.3(1c)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.4\(1a\):*:*:*:*:*:*:*1.4(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.4\(1b\):*:*:*:*:*:*:*1.4(1b)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.4\(1c\):*:*:*:*:*:*:*1.4(1c)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.5\(1a\):*:*:*:*:*:*:*1.5(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.5\(1b\):*:*:*:*:*:*:*1.5(1b)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:1.5\(1c\):*:*:*:*:*:*:*1.5(1c)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1a\):*:*:*:*:*:*:*2.0(1a)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1b\):*:*:*:*:*:*:*2.0(1b)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1c\):*:*:*:*:*:*:*2.0(1c)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1d\):*:*:*:*:*:*:*2.0(1d)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1e\):*:*:*:*:*:*:*2.0(1e)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1f\):*:*:*:*:*:*:*2.0(1f)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1g\):*:*:*:*:*:*:*2.0(1g)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1h\):*:*:*:*:*:*:*2.0(1h)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1i\):*:*:*:*:*:*:*2.0(1i)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1j\):*:*:*:*:*:*:*2.0(1j)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1k\):*:*:*:*:*:*:*2.0(1k)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1l\):*:*:*:*:*:*:*2.0(1l)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1m\):*:*:*:*:*:*:*2.0(1m)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1n\):*:*:*:*:*:*:*2.0(1n)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1o\):*:*:*:*:*:*:*2.0(1o)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1p\):*:*:*:*:*:*:*2.0(1p)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1q\):*:*:*:*:*:*:*2.0(1q)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1r\):*:*:*:*:*:*:*2.0(1r)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1s\):*:*:*:*:*:*:*2.0(1s)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1t\):*:*:*:*:*:*:*2.0(1t)VulnerableCisco
cpe:2.3:a:cisco:ucs_central_software:2.0\(1u\):*:*:*:*:*:*:*2.0(1u)VulnerableCisco
  • cpe:2.3:a:cisco:ucs_central_software:1.3\(1c\):*:*:*:*:*:*:* Versions 1.3(1c) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.4\(1a\):*:*:*:*:*:*:* Versions 1.4(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.4\(1b\):*:*:*:*:*:*:* Versions 1.4(1b) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.4\(1c\):*:*:*:*:*:*:* Versions 1.4(1c) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.5\(1a\):*:*:*:*:*:*:* Versions 1.5(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.5\(1b\):*:*:*:*:*:*:* Versions 1.5(1b) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:1.5\(1c\):*:*:*:*:*:*:* Versions 1.5(1c) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1a\):*:*:*:*:*:*:* Versions 2.0(1a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1b\):*:*:*:*:*:*:* Versions 2.0(1b) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1c\):*:*:*:*:*:*:* Versions 2.0(1c) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1d\):*:*:*:*:*:*:* Versions 2.0(1d) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1e\):*:*:*:*:*:*:* Versions 2.0(1e) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1f\):*:*:*:*:*:*:* Versions 2.0(1f) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1g\):*:*:*:*:*:*:* Versions 2.0(1g) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1h\):*:*:*:*:*:*:* Versions 2.0(1h) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1i\):*:*:*:*:*:*:* Versions 2.0(1i) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1j\):*:*:*:*:*:*:* Versions 2.0(1j) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1k\):*:*:*:*:*:*:* Versions 2.0(1k) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1l\):*:*:*:*:*:*:* Versions 2.0(1l) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1m\):*:*:*:*:*:*:* Versions 2.0(1m) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1n\):*:*:*:*:*:*:* Versions 2.0(1n) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1o\):*:*:*:*:*:*:* Versions 2.0(1o) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1p\):*:*:*:*:*:*:* Versions 2.0(1p) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1q\):*:*:*:*:*:*:* Versions 2.0(1q) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1r\):*:*:*:*:*:*:* Versions 2.0(1r) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1s\):*:*:*:*:*:*:* Versions 2.0(1s) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1t\):*:*:*:*:*:*:* Versions 2.0(1t) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ucs_central_software:2.0\(1u\):*:*:*:*:*:*:* Versions 2.0(1u) Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-20280
  2. 2026-10-03 Alias added: GHSA-jm5c-w4xp-6794

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-06724 OS command injection in Cisco Unified Computing System CVSS 3.1MEDIUM 6.7
  • TI-2023-06725 Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2023-06721 Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences