CVE-2020-3250: Cisco UCS Director REST API authentication bypass and directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network-reachable, unauthenticated authentication bypass and directory traversal, plus very high EPSS and public exploit references, makes this an urgent patch target.

What it is

Multiple vulnerabilities in the REST API of Cisco UCS Director and UCS Director Express for Big Data allow a remote, unauthenticated attacker to bypass authentication or perform directory traversal. The advisory is thin on per-flaw detail, but the CVSS vector and CWE entries point to improper input validation and privilege management issues in the API layer.

Impact

An attacker can bypass authentication and reach privileged API functionality, or traverse directories to read files outside the intended path. With C:H/I:H/A:H, successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected appliance.

Attack surface

Reached over the network via the REST API (AV:N, PR:N, UI:N), so no credentials or user interaction are required. Any internet- or network-exposed UCS Director REST endpoint is in scope.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.60947 (99.1st percentile) and public references include a Packet Storm post titled 'Cisco UCS Director Cloupia Script Remote Code Execution', indicating public exploit material exists.

What to do

• Apply the Cisco security advisory cisco-sa-ucsd-mult-vulns-UNfpdW4E fixes for UCS Director and UCS Director Express for Big Data as the first action.
• Restrict network access to the REST API to trusted management networks; do not expose it to the internet.
• Rotate credentials and review API tokens/accounts on affected appliances after patching, since authentication bypass may have allowed unauthorized access.
• Monitor for and remove any unauthorized Cloupia scripts or scheduled tasks that could indicate prior exploitation.
• If patching cannot be done immediately, isolate affected appliances behind strict firewall rules and increase logging on the REST API.

Detection

• Review REST API access logs for unauthenticated or anomalous requests, especially path traversal patterns such as ../ sequences.
• Alert on creation or execution of Cloupia scripts and unexpected scheduled jobs on UCS Director.
• Monitor for unusual outbound connections or file reads from the UCS Director host that could indicate post-exploitation activity.
• Correlate authentication bypass indicators with subsequent privileged API calls in the same session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.