CVE-2020-3251: Cisco UCS Director REST API authentication bypass and path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact and a very high EPSS score, though exploitation requires low privileges and no KEV listing exists.

What it is

The REST API of Cisco UCS Director and UCS Director Express for Big Data contains multiple input validation flaws, including an authentication bypass and directory traversal. A remote attacker with low-privilege credentials can reach sensitive functionality and files, making this a serious risk for exposed management interfaces.

Impact

An attacker can bypass authentication to reach protected API functions and use path traversal to read or write files outside the intended directory, potentially compromising the management appliance and data it controls.

Attack surface

Reachable over the network through the REST API (AV:N, AC:L, PR:L, UI:N); the vector indicates low privileges are required rather than none, so some form of authenticated access is needed. No user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is high at 0.615 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Cisco security advisory updates for UCS Director and UCS Director Express for Big Data as soon as possible.
• Restrict network access to the REST API and management interfaces to trusted management networks only.
• Audit and rotate credentials for low-privilege API accounts that could be used to reach the vulnerable endpoints.
• Monitor and review file system changes on the appliance for signs of traversal-based reads or writes.

Detection

• Review REST API access logs for anomalous requests containing path traversal sequences such as ../ or encoded variants.
• Alert on API calls from low-privilege accounts reaching administrative or file-handling endpoints.
• Monitor the appliance file system for unexpected file creation or modification outside normal application paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.