CVE-2020-3247: Cisco UCS Director REST API authentication bypass and path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and very high EPSS make this a top remediation priority despite no KEV listing.

What it is

The REST API of Cisco UCS Director and UCS Director Express for Big Data contains multiple input validation flaws that let a remote attacker bypass authentication or perform directory traversal. Because the API is network-exposed and no credentials are required, the issue is serious for any internet- or management-network-reachable deployment.

Impact

An attacker can reach protected API functionality without authenticating and read or write files outside the intended directory, potentially leading to full compromise of the affected appliance.

Attack surface

Reached over the network via the REST API (AV:N, PR:N, UI:N); no authentication or user interaction is needed per the CVSS vector and description.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is very high (0.756, 99.5th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Cisco security advisory fixes for UCS Director and UCS Director Express for Big Data as the first action.
• Restrict REST API access to trusted management networks and block it from the internet.
• Enforce authentication and input validation at any reverse proxy or gateway in front of the API.
• Monitor vendor advisory for updated fixed releases and re-verify exposure after patching.

Detection

• Review REST API access logs for unauthenticated or anomalous requests, especially traversal patterns such as ../ sequences.
• Alert on unexpected file access or writes outside expected directories on UCS Director hosts.
• Correlate API request bursts from single sources with authentication failures or bypass attempts.
• Audit exposed management interfaces to confirm the REST API is not reachable from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.