{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:13:00Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20150709-CVE-2015-4259","slug":"cisco-sa-20150709-cve-2015-4259","vendor":"Cisco","title":"Cisco Unified Computing System C-Series Servers Man-in-the-Middle Vulnerability","summary":"A vulnerability in the Cisco Integrated Management Controller of the Cisco Unified Computing System (UCS) C-Series Servers could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device. The vulnerability is due to improper validation of the SSL certificate used to manage the device. An attacker could exploit this vulnerability by using the default SSL certificate to intercept, decrypt, read, and write information. Cisco has confirmed the vulnerability; however, software updates are not available. A successful exploit of this vulnerability could allow the attacker to impact the confidentiality of information transmitted by the device by decrypting encrypted content and accessing sensitive information, which could be used to conduct further attacks. The attacker may need access to trusted, internal networks to use the default SSL certificate used to manage the device, making exploitation more difficult in environments that restrict access to untrusted sources. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.","severity":"Medium","published_at":"2015-07-09T19:56:46Z","updated_at":"2015-07-09T19:56:46Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150709-CVE-2015-4259","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20150709-CVE-2015-4259/csaf/Cisco-SA-20150709-CVE-2015-4259.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":2,"public_evidence_count":2,"kev_count":0,"highest_epss":0.00775},"cves":[{"id":"CVE-2015-4259","kev":false,"epss":{"score":0.00775,"percentile":0.51673,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"}}],"public_evidence":[{"product":{"name":"Cisco Unified Computing System (Standalone)","slug":"cisco-unified-computing-system-standalone","vendor":"Cisco"},"cve":{"id":"CVE-2015-4259"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:15:50Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified Computing System (Standalone)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00775,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"},"published_at":"2015-07-09T19:56:46Z","updated_at":"2015-07-09T19:56:46Z","advisory_updated_at":"2015-07-09T19:56:46Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150709-CVE-2015-4259","row_display_order":1},{"product":{"name":"Cisco Unified Computing System (Management Software)","slug":"cisco-unified-computing-system-management-software","vendor":"Cisco"},"cve":{"id":"CVE-2015-4259"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:15:50Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified Computing System (Management Software)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00775,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"},"published_at":"2015-07-09T19:56:46Z","updated_at":"2015-07-09T19:56:46Z","advisory_updated_at":"2015-07-09T19:56:46Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150709-CVE-2015-4259","row_display_order":2}]}