This vulnerability exists in the UEFI Shell implementation on Cisco UCS Servers and UCS-based appliances. It allows attackers with either valid user/admin credentials or physical access to select the UEFI Shell boot option and use memory write commands to modify UEFI memory variables. This bypasses UEFI Secure Boot validation checks, enabling execution of unauthorized software in the preboot environment. The vulnerability stems from the availability of memory write commands while Secure Boot is enabled. Affected versions include numerous specific releases of Cisco Enterprise NFV Infrastructure Software as listed.

Successful exploitation can allow attackers to bypass UEFI Secure Boot protections, manipulate the preboot environment, and execute unauthorized software. This compromises system integrity and could lead to persistent unauthorized control over affected devices. The CVSS v3.1 score is 7.1 (High), reflecting the potential for high confidentiality and integrity impact with low attack complexity but requiring local or physical access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected devices and limit user roles to trusted personnel. Monitor vendor communications for updates on patches or mitigations specific to this vulnerability.