CVE-2020-3329
mediumpriority · track · 17EPSS 0.007 · 52 %ileEUUSEPSS · scored 2026-10-27
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No fix is available; mitigate or reduce exposure.
- No fix availableCisco Integrated Management Controller (IMC) Supervisorcisco_csaf
No remediation is available at this time.
- No fix availableCisco UCS Directorcisco_csaf
No remediation is available at this time.
- No fix availableCisco Unified Computing System Director Express for Big Data cisco_csaf
No remediation is available at this time.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- cisco integrated management controller supervisor1.1.0.0 → 2.2.1.3nvdUScpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*
- cisco ucs director express for big data2.0.0.0 → 3.7.4.0nvdUScpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- cisco-sa-ucsd-Ar6BAguzCisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability2020-05-06csaf · cisco_csafUS
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2020-3329cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzcnnvd
- https://vigilance.fr/vulnerability/Cisco-Unified-Computing-System-Director-privilege-escalation-32207cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.1618/cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzenisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan