PT-2020-4948 · Cisco · Cisco Security Manager

Florian Hauser · Published 2020-11-16 · Updated 2020-11-30 · CVE-2020-27125

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Security Manager (affected versions not specified)

Description: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The issue is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by viewing source code, potentially allowing them to view static credentials and carry out further attacks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05523

CVE-2020-27125

Affected Products

Cisco Security Manager

References · 8

• https://osv.dev/vulnerability/CVE-2020-27125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27125 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05523 · Security Note
• https://t.me/cvenotify/5682 · Telegram Post
• https://t.me/cybersecuritytechnologies/2127 · Telegram Post
• https://t.me/cibsecurity/16422 · Telegram Post
• https://t.me/freedomf0x/10637 · Telegram Post