CVE-2021-1354: Cisco Unified Computing System Central Software Improper Certificate Validation Vulnerability

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-04 · updated 2026-06-17
Weakness: CWE-295

Description

A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.

Affected products

Cisco UCS Central Software: before 2.0\(1m\) — fixed in 2.0\(1m\)

How to fix

Upgrade to a fixed version: Cisco UCS Central Software 2.0\(1m\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1354 or the next vulnerability affects your stack