CVE-2020-3382
Cisco Data Center Network Manager Authentication Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.
Una vulnerabilidad en la API REST de Cisco Data Center Network Manager (DCNM), podría permitir a un atacante remoto no autenticado omitir la autenticación y ejecutar acciones arbitrarias con privilegios administrativos sobre un dispositivo afectado. La vulnerabilidad se presenta porque las diferentes instalaciones comparten una clave de cifrado estático. Un atacante podría explotar esta vulnerabilidad utilizando la clave estática para crear un token de sesión válido. Una explotación con éxito podría permitir al atacante llevar a cabo acciones arbitrarias por medio de la API REST con privilegios administrativos
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2019-12-12 CVE Reserved
- 2020-07-31 CVE Published
- 2024-09-07 EPSS Updated
- 2024-11-13 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-798: Use of Hard-coded Credentials
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Data Center Network Manager Search vendor "Cisco" for product "Data Center Network Manager" | < 11.4\(1\) Search vendor "Cisco" for product "Data Center Network Manager" and version " < 11.4\(1\)" | - |
Affected
|