Security readout for executives and security teams
Plain-English summary
This vulnerability lets a low-privileged, read-only account disable other users, including administrators, in affected Cisco management products. It does not expose data or grant full control by itself, but it can disrupt administration and recovery if an attacker already has a valid account.
Executive priority
Prioritize based on whether these Cisco management consoles are internet-exposed, broadly reachable internally, or used for critical infrastructure operations. The business risk is administrative disruption, especially if a compromised low-privilege account can disable administrators during an incident.
Technical view
CVE-2020-3329 is an RBAC flaw in Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data. The enable/disable action was incorrectly available to read-only users, allowing authenticated remote role updates that disable accounts. CVSS v3.0 is 4.3, with low attack complexity and required privileges.
Likely exposure
Exposure is limited to organizations running the named Cisco management platforms with reachable authenticated access paths. The source bundle does not provide affected version ranges, so teams must confirm product versions against Cisco’s advisory and internal asset inventory.
Exploitation context
Sources describe exploitation by an authenticated read-only remote user abusing incorrect RBAC behavior. There is no KEV listing in the bundle and no cited evidence of active exploitation. Treat this as an insider, stolen-credential, or weak-account-control risk rather than unauthenticated compromise.
Researcher notes
Evidence is strong for the vulnerability behavior and severity, but incomplete for affected version ranges and fixed releases in the supplied bundle. Do not assume exploit activity. Focus validation on RBAC enforcement, account-change auditing, and vendor-confirmed remediation status.
Mitigation direction
- Identify Cisco IMC Supervisor, UCS Director, and UCS Director Express for Big Data deployments.
- Review the Cisco advisory for affected and fixed release guidance.
- Restrict management access to trusted networks and approved administrators.
- Remove unnecessary read-only accounts and stale user access.
- Monitor for unexpected account disablement or role changes.
Validation and detection
- Compare installed product versions with Cisco advisory guidance.
- Confirm read-only roles cannot disable users after remediation.
- Review audit logs for read-only users changing roles or disabling accounts.
- Verify administrator accounts remain accessible and recovery accounts are protected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-3329 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.3MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 20200506 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.