PT-2019-2510 · Cisco · Cisco Data Center Network Manager

Pedro Ribeiro · Published 2019-06-26 · Updated 2020-10-06 · CVE-2019-1621

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The issue is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this by connecting to the web-based management interface and requesting specific URLs, potentially allowing them to download arbitrary files from the underlying filesystem of the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-264

CWE-22

Related Identifiers

BDU:2019-02353

CVE-2019-1621

Affected Products

Cisco Data Center Network Manager

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_dcnm_download.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1621 · Security Note
• https://bdu.fstec.ru/vul/2019-02353 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-file-dwnld · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1621 · Vendor Advisory
• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.html · Note
• http://securityfocus.com/bid/108904 · Note
• https://seclists.org/bugtraq/2019/Jul/11 · Note
• http://seclists.org/fulldisclosure/2019/Jul/7 · Note