Cisco UCS 4.3(5a) Security Fixes: CVE-2024-6387 & libexpat

Cisco UCS Manager 4.3 release notes: security fixes section

Short answer: Cisco UCS 4.3(5a), released 22 October 2024, lists three security fixes in the current UCS Manager 4.3 release notes. CSCwk62264 covers OpenSSH “regreSSHion” (CVE-2024-6387) on 6400/6500 Fabric Interconnects in UCS Manager mode. CSCwk62723 covers the same CVE in Serial over LAN on B-Series and X-Series. CSCwk75392 covers libexpat CVE-2023-52425 in UCS Manager. Later 4.3 releases add more fixes; 4.3(6j) is the newest.

Table of Contents

Cisco UCS 4.3(5a) security fixes

Defect ID	Affected component	CVE	What it is
CSCwk62264	UCS 6400 and 6500 Series Fabric Interconnects in UCS Manager mode	CVE-2024-6387	OpenSSH sshd signal-handler race (a regression of CVE-2006-5051). An unauthenticated remote attacker can trigger it by not authenticating within the login grace time.
CSCwk62723	UCS B-Series blade servers and X-Series compute nodes, Serial over LAN (SOL)	CVE-2024-6387	The same OpenSSH issue in the SOL component used for remote console access
CSCwk75392	Cisco UCS Manager	CVE-2023-52425	libexpat through 2.5.0: denial of service (resource consumption) when a large token needs many full reparsings

For every entry, Cisco uses the same wording: the affected third-party component “has been upgraded to a version that includes fixes for the vulnerability”. None of the three has a configuration workaround listed. The fix is the upgrade.

What changed since my original post

My October 2024 version also listed CSCwb81661 (OpenSSL CVE-2021-4160, CVE-2022-0778, CVE-2022-1292) under 4.3(5a). The current release notes do not list that defect in the 4.3(5a) section. CVE-2022-0778 appears under 4.3(2c) as CSCwh46667.
CVE-2024-6387 is also listed under 4.3(4c) as CSCwk62264 for “Cisco UCS Manager”. So the OpenSSH fix arrived in two steps: UCS Manager in 4.3(4c), and the Fabric Interconnect and SOL components in 4.3(5a).

Security fixes after 4.3(5a)

Upgrading to 4.3(5a) alone is no longer enough. These are the later 4.3 security fixes, from the same release notes:

Release	Defect ID	Scope
4.3(5c)	CSCwm73573	Intel CPU and firmware CVEs on C-Series M7 and X-Series M7 (for example CVE-2024-27457, CVE-2024-23918, CVE-2024-21820)
4.3(5d)	none	No security fixes
4.3(6a)	CSCwm82813, CSCwm73565	A large set of OpenSSL CVEs in UCS Manager third-party software, and CVE-2024-28047 (Intel UEFI) on M5 servers
4.3(6c)	CSCwo49706, CSCwo49702, CSCwo49711	Intel CVE-2024-45332 on M5/M6, plus CVE-2025-20103 and CVE-2025-20054 on M7
4.3(6d)	CSCwq36167	Intel CVE-2025-20067 on M6, and CVE-2025-21096, CVE-2025-20053, CVE-2025-24305, CVE-2025-20613, CVE-2025-21090, CVE-2025-22853 on M7
4.3(6f)	CSCwn23026, CSCwm68934	UCS Manager’s own vulnerabilities: CVE-2023-20077 (command injection by an authenticated admin) and CVE-2023-20076 (privilege escalation from read-only CLI)
4.3(6b), 4.3(6e), 4.3(6g), 4.3(6h), 4.3(6i)	none	No security fixes

Which Cisco UCS 4.3 release to run now

Newest 4.3 release: 4.3(6j), added to the release notes on 24 September 2026. Cisco also publishes UCS Manager 6.0 release notes.
Avoid 4.3(4a) to 4.3(4d): Cisco has deprecated them and removed their firmware files, and recommends 4.3(4e) or later. See FN74201 (UCS Manager inaccessible after upgrade with integrated S3260) and FN74209 (vFC interfaces may flap). FN74209 lists 4.3(4e) and 4.3(5a) as fixed releases.
Cisco publishes no single “recommended” 4.3 build in the release notes. Pick the newest release that supports your server generations, VIC firmware and ESXi drivers, and follow the upgrade path tables in the release notes. Per the 4.3(6) table, you can upgrade directly from any 4.3(x), 4.2(2) or 4.2(3) release, and from 4.2(1i) or a later 4.2(1) patch.

Upgrade order for a UCS domain

Check the upgrade path table for your current release in the 4.3 release notes.
Upgrade the infrastructure A bundle (UCS Manager, NX-OS on the Fabric Interconnects, IOM and FEX firmware). This carries the UCS Manager and FI fixes such as CSCwk62264 and CSCwk75392.
Upgrade the server bundles (B/C/X) through host firmware packages. The SOL fix (CSCwk62723) and the Intel CPU/BIOS fixes are server-side components. Put each ESXi host into maintenance mode first.
Update the ESXi nenic/nfnic drivers to the versions that match the new VIC firmware.