PT-2019-2508 · Cisco · Cisco Data Center Network Manager

Pedro Ribeiro · Publicado 2019-06-26 · Atualizado 2020-10-06 · CVE-2019-1619

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The issue is due to improper session management on affected DCNM software. An attacker could exploit this by sending a crafted HTTP request to the affected device, potentially gaining administrative access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-284

CWE-798

Identificadores relacionados

BDU:2019-02351

CVE-2019-1619

Produtos afetados

Cisco Data Center Network Manager

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cisco_dcnm_upload_2019.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_dcnm_download.rb · Exploit
• 🔥 https://exploit-db.com/exploits/47347 · Exploit
• http://securityfocus.com/bid/108902 · Nota
• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.html · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-bypass · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2019/Jul/7 · Nota
• https://osv.dev/vulnerability/CVE-2019-1619 · Aviso do Fabricante
• https://seclists.org/bugtraq/2019/Jul/11 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1619 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1619 · Nota de Segurança
• http://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.html · Nota
• https://bdu.fstec.ru/vul/2019-02351 · Nota de Segurança