by Kastro
Paper/Archive/CVE-2020-3382

CVE-2020-3382

Cisco Cisco Data Center Network Manager — Cisco Data Center Network Manager Authentication Bypass Vulnerability

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.3.833 × 2016.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.

Affected

ProductAffectedFixed inSource
Cisco Data Center Network Managern/a–CNA

Scores by source

cisco (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-bypass-dyEejUMs