PT-2020-4894 · Cisco · Cisco Iot Field Network Director

Published 2020-11-18 · Updated 2020-12-01 · CVE-2020-3392

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director (affected versions not specified)

Description: A vulnerability in the API of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The issue exists due to the software's failure to properly authenticate API calls. An attacker could exploit this by sending API requests to an affected system, potentially allowing them to view sensitive information, including details about managed devices, without authentication.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2020-05469

CVE-2020-3392

Affected Products

Cisco Iot Field Network Director

References · 5

• https://osv.dev/vulnerability/CVE-2020-3392 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05469 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-APIA-xZntFS2V · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3392 · Security Note
• https://t.me/cibsecurity/16527 · Telegram Post