Pierluigi Paganini July 31, 2020

Cisco addressed critical and high-severity vulnerabilities affecting its Data Center Network Manager (DCNM) network management platform.

Cisco addressed this week some critical and high-severity vulnerabilities impacting its Data Center Network Manager (DCNM) network management platform.

One of the most security issues is a critical authentication bypass vulnerability, tracked as CVE-2020-3382. The vulnerability can allow a remote, unauthenticated attacker to bypass authentication and perform actions with admin privileges on the vulnerable device.

“A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.” reads the advisory published by Cisco.

“The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.”

The company also addressed several high-severity vulnerabilities in Data Center Network Manager (DCNM). The list of high-severity issues includes CVE-2020-3377, CVE-2020-3384, CVE-2020-3383, CVE-2020-3386, CVE-2020-3376, they are arbitrary command injection, path traversal and arbitrary file writing, and bypassing authorization and escalating privileges flaws.

The tech giant states that most of these vulnerabilities could be exploited only by authenticated attackers, only the CVE-2020-3376 issue could be exploited by an unauthenticated attacker to bypass authentication and execute arbitrary actions.

“A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on an affected device.” reads the security advisory.

“The vulnerability is due to a failure in the software to perform proper authentication. An attacker could exploit this vulnerability by browsing to one of the hosted URLs in Cisco DCNM. A successful exploit could allow the attacker to interact with and use certain functions within the Cisco DCNM.”

Cisco also fixed three medium-severity vulnerabilities in DCNM, including XSS, SQL injection and information disclosure issues.

This week, Cisco also addressed a critical vulnerability in the management interface of the SD-WAN vManage software tracked as CVE-2020-3374. The issue can be exploited by an authenticated attacker to access potentially sensitive information, modify the configuration of the system, or trigger a DoS condition.

The good news is that none of these vulnerabilities has been exploited by threat actors in the wild.

Pierluigi Paganini

(SecurityAffairs – hacking, DCNM)

[adrotate banner=”5″]

[adrotate banner=”13″]