Security fixes

You can view the open issues, resolved issues, and security fixes using the Cisco Bug Search Tool.

Security Fixes in Cisco UCS X-Series M8 6.0(1.252114), M7, M6 6.0(1.250179), B-Series M6, M5 6.0(1.250169), and C-Series M8, M7, M6 6.0(1.250192) Server Firmware Release — None

Security Fixes in Cisco UCS XE-Series M8 Server Firmware Release, 6.0(1.251030) — None

Security Fixes in Cisco UCS X-Series M8 6.0(1.252039) Server Firmware Release — None

Security Fixes in Cisco UCS C-Series M8, M7, M6 6.0(1.250174) Server Firmware Release

This section provides a brief description of the security fixes.

Defect ID - CSCwq36167

The Cisco UCS C-Series M6 Rack Servers include an Intel CPU that is affected by the vulnerability identified by the following Common Vulnerability and Exposures (CVE) ID:

  • CVE-2025-20067 — Observable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable information disclosure via local access.

The affected third-party software component has been upgraded to a version that includes fixes for the vulnerability. Future versions of the product(s) will not be affected by this vulnerability.

Defect ID - CSCwq36171

The Cisco UCS C-Series M7 Rack Servers include an Intel CPU that is affected by the vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs:

  • CVE-2025-21096 — Improper buffer restrictions in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.

  • CVE-2025-20053 — Improper buffer restrictions for some Intel(R) Xeon(R) Processor firmware with SGX enabled may allow a privileged user to potentially enable escalation of privilege via local access.

  • CVE-2025-24305 — Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.

  • CVE-2025-20613 — Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable information disclosure via local access.

  • CVE-2025-21090 — Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable denial of service via local access.

  • CVE-2025-22853 — Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.

The affected third-party software component has been upgraded to a version that includes fixes for the vulnerability. Future versions of the product(s) will not be affected by this vulnerability.

Security Fixes in Cisco UCS X-Series M8, M7, M6 6.0(1.250122), B-Series M6, M5 6.0(1.250127), and C-Series M8, M7, M6 6.0(1.250131) Server Firmware Release — None

Security fixes in Cisco UCS X-Series M8, M7, M6 6.0(1.250120), B-Series M6, M5 6.0(1.250126), and C-Series M8, M7, M6 6.0(1.250127) Server Firmware Release

This section provides a brief description of the security fixes.

Defect ID - CSCwm98102

The Cisco products UCS B-Series Blade Servers, UCS C-Series Rack Servers and UCS X-Series Compute Nodes may include an optional Trusted Platform Module (TPM) 2.0 that is affected by the vulnerability identified by the following Common Vulnerability and Exposures (CVE) ID:

  • CVE-2025-2884 — TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0.

    Cisco UCS servers equipped with one of the following optional TPM modules:

    • UCSX-TPM2-002

    • UCSX-TPM-002C

    • UCS-TPM-002D

    • UCSX-TPM-002D

The affected third-party software component has been upgraded to a version that includes fixes for the vulnerability. Future versions of the product(s) will not be affected by this vulnerability.