CVE-2024-20280
MEDIUMDescription
A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key.
Is your site exposed to CVE-2024-20280?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
| cisco | ucs_central_software |
References
Frequently Asked Questions
What is CVE-2024-20280? +
How severe is CVE-2024-20280? +
What products are affected by CVE-2024-20280? +
How do I check if I'm vulnerable to CVE-2024-20280? +
Related Vulnerabilities
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to …
The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to …
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to …
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the …
This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An …
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key …