PT-2020-4236 · Cisco · Cisco Data Center Network Manager

Published 2020-07-29 · Updated 2020-08-05 · CVE-2020-3376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description: A vulnerability in the Device Manager application of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on an affected device. The issue is due to a failure in the software to perform proper authentication for a critical function. An attacker could exploit this by browsing to one of the hosted URLs in Cisco DCNM, potentially allowing them to interact with and use certain functions within the Cisco DCNM.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2020-04676

CVE-2020-3376

Affected Products

Cisco Data Center Network Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3376 · Security Note
• https://bdu.fstec.ru/vul/2020-04676 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-auth-bypass-JkubGpu3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3376 · Vendor Advisory