CVE-2020-3243: Cisco UCS Director REST API authentication bypass and directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network-reachable, unauthenticated authentication bypass and traversal, plus very high EPSS, makes this a top remediation priority.

What it is

The REST API of Cisco UCS Director and UCS Director Express for Big Data contains multiple input validation and privilege management flaws that let a remote attacker bypass authentication or perform directory traversal. Because the API is network-exposed and unauthenticated access is possible, these issues are serious for any internet- or broadly reachable deployment.

Impact

An attacker can reach protected API functionality without valid credentials and read or manipulate files outside intended directories, potentially leading to full compromise of the affected device.

Attack surface

Reached over the network via the REST API (CVSS vector AV:N/PR:N/UI:N), so no authentication or user interaction is required. Any host that can reach the API endpoint is a potential entry point.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.88374, 99.76th percentile) and public references include a Packet Storm posting titled for remote code execution, indicating public exploit interest.

What to do

• Apply the Cisco security advisory fixes for UCS Director and UCS Director Express for Big Data as the first action.
• Restrict network access to the REST API to trusted management networks and block it from the internet.
• Enforce strong authentication and review API accounts for unnecessary privileges.
• Monitor vendor advisory updates for any revised fixed versions or workarounds.

Detection

• Review REST API access logs for unauthenticated or anomalous requests, especially traversal patterns such as ../ sequences.
• Alert on unexpected file access or writes outside expected UCS Director directories.
• Monitor for suspicious processes or script execution on UCS Director hosts consistent with post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.