Beginning with the release 4.3, Cisco is updating the release number naming convention to align with the .ISO images.

Example: 4.3.1.YYXXXX

• 4.3—Represents the main release.

• .1—Represents the first release.

  For the current 4.3 main release, .1 represents the first release number.

  For subsequent maintenance releases, this number will represent the related maintenance release number.

• YY—Represents the year of release.

  For the current 4.3 main release, 23 is derived from the year 2023.

• XXXX—The final 4 digits represent the increasing sequence of build numbers every year.

  For the first 4.3 main release, the number is 0097.

For detailed information about supported Operating System, see the interactive UCS Hardware and Software Compatibility matrix.

Cisco recommends the following browsers for Cisco UCS Rack Server Software, Release 4.3(5):

Note	If the management client is launched using an unsupported browser, check the help information from the For best results use supported browsers option available in the login window for the supported browser versions.

Transport Layer Security (TLS) version 1.2.

The section provides information on the upgrade paths to release 4.3.5.

Cisco IMC 4.3(5.240021)​ release supports Cisco UCS C225 M8 server in addition to the following servers:

• Cisco UCS C245 M8

• Cisco UCS C220 M7

• Cisco UCS C240 M7

• Cisco UCS C220 M6

• Cisco UCS C240 M6

• Cisco UCS C245 M6

• Cisco UCS C225 M6

• Cisco UCS S3260 M5

To get a complete overview of all the possible upgrade paths in Cisco IMC, see Cisco UCS Rack Server Upgrade Support Matrix.

Downgrade Limitation for Release 4.3(4.240152):

See Cisco UCS Rack Server Upgrade Support Matrix to view your server upgrade path.

Downgrade Limitation for Release 4.3(3.240022):

In the release 4.3(3.240022), you cannot downgrade the Cisco UCS M7 servers with 5th Gen Intel® Xeon® processors.

When you try to downgrade Cisco IMC, the following error message is displayed on CLI, GUI, Redfish API and XML API user interfaces:

Error message during BMC downgrade with different interfaces like CLI/WEBUI/Redfish/XML =

“Update aborted. INCOMPATIBLE_IMAGE”

When you try to downgrade BIOS, the following error message is displayed on CLI, GUI, Redfish API and XML API user interfaces:

CPU ID mismatch between uploaded image and the platform.

Note	You can downgrade Cisco UCS M7 servers with 4th Generation Intel® Xeon® Scalable Processors.

Infrastructure Upgrade and Downgrade to Release 4.3(2):

• Cisco UCS M4 servers are not supported by 4.3(2.230207) and later releases.

• You must perform firmware update after adding any new hardware component to the system.

• If you are planning to install Cisco UCS VIC 15237 or 15427 in a server, then upgrade the server to 4.3(2.230270) or later versions and then insert the adapter into the server.

  If you insert Cisco UCS VIC 15237 or 15427 into the server that is running earlier versions than 4.3(2.230270), then upgrade the server to 4.3(2.230270) or later versions and power cycle the server to recognize the adapter.

• If you are planning to install Cisco UCS VIC 15235 or 15425 in a server, then upgrade the server to 4.3(2.230207) or later versions and then insert the adapter into the server.

  If you insert Cisco UCS VIC 15235 or 15425 into the server that is running earlier versions than 4.3(2.230207), then upgrade the server to 4.3(2.230207) or later versions and power cycle the server to recognize the adapter.

Support for Cisco UCS C245 M8 Servers

Cisco UCS C245 M8 servers are supported from the release 4.3(4.241014) onwards.

Support for Cisco UCS M7 Servers

Cisco UCS M7 servers are supported from the release 4.3(1.230097) onwards.

The following releases are for Cisco UCS M7 servers only:

• 4.3(1.230138)

• 4.3(1.230124​)

• 4.3(1.230097)

Release 4.3(3.240022)

Beginning with Cisco IMC release 4.3(3.240022), the following Cisco UCS M5 servers are not supported:

• Cisco UCS C125 M5

• Cisco UCS C220 M5

• Cisco UCS C240 M5

• Cisco UCS C240 SD M5

• Cisco UCS C480 M5

• Cisco UCS C480 ML M5

The Cisco UCS M5 servers mentioned above will continue to be supported on the final supported software release version (4.3(2.x)) with applicable patches, going forward.

The following defect was resolved in Release 4.3(5.250045):

The following defect was resolved in Release 4.3(5.250043):

The following defects were resolved in Release 4.3(5.250033):

The following defects were resolved in Release 4.3(5.250030):

The following defects were resolved in Release 4.3(5.250001):

The following defects are open in Release 4.3(5.250001):

The following defects are open in Release 4.3(5.240021)​:

Known Behaviors and Limitations

The following caveats are known limitations in release 4.3(5.250001):

Known Behaviors and Limitations

The following caveats are known limitations in release 4.3(5.240021)​:

Defect ID - CSCwn63691

Cisco UCS C225 M6 and C245 M6 servers are affected by vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs:

• CVE-2024-56161—Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.

• CVE-2024-21925—Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution.

• CVE-2024-21924—SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbitrary code execution..

Defect ID - CSCwm73573

Cisco UCS M7 servers are affected by vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs:

• CVE-2024-27457—Improper check for unusual or exceptional conditions in Intel(R) TDX Module firmware before version 1.5.06 may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-23918—Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-21820—Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-21853—Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access.

• CVE-2024-25565—Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial of service via local access.

• CVE-2024-23984—Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-24968—Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via local access.

• CVE-2024-22185—Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-24985—Exposure of resource to wrong sphere in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-21829—Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-23599—Race condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial of service via local access.

• CVE-2024-21781—Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or denial of service via local access.

• CVE-2024-39279—Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.

• CVE-2024-28047—Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-31157—Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-36293—Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.

• CVE-2024-31068—Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.

• CVE-2024-25571—Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via local access.

• CVE-2024-21859—Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-31155—Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-37020—Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

Defect ID - CSCwk90710

Cisco UCS M6 servers are affected by vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs:

• CVE-2024-24853—Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-24980—Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-21829—Improper input validation in UEFI firmware error handler for some Intel® Processors may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2024-21781—Improper input validation in UEFI firmware for some Intel® Processors may allow a privileged user to enable information disclosure or denial of service via local access.

• CVE-2023-43753—Improper conditions check in some Intel(R) Processors with Intel® Software Guard Extensions (Intel® SGX) may allow a privileged user to potentially enable information disclosure via local access.

• CVE-2024-24968—Improper finite state machines (FSMs) in hardware logic in some Intel® Processors may allow an privileged user to potentially enable a denial of service via local access.

• CVE-2024-23984—Observable discrepancy in RAPL interface for some Intel® Processors may allow a privileged user to potentially enable information disclosure via local access.