PT-2020-4951 · Cisco · Cisco Iot Field Network Director

Published 2020-11-18 · Updated 2020-11-25 · CVE-2020-26079

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco IoT Field Network Director (affected versions not specified)

Description: The issue is related to insufficient protection of user credentials in the web UI of the software. This could allow a remote attacker to obtain hashes of user passwords on an affected device. The attacker must be authenticated and could exploit this by logging in as an administrative user and crafting a call for user information. A successful exploit could allow the attacker to obtain hashes of user passwords.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Insufficiently Protected Credentials

Weakness Enumeration

CWE-89

CWE-522

CWE-256

Related Identifiers

BDU:2020-05526

CVE-2020-26079

Affected Products

Cisco Iot Field Network Director

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-PWH-yCA6M7p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26079 · Security Note
• https://bdu.fstec.ru/vul/2020-05526 · Security Note
• https://t.me/cibsecurity/16518 · Telegram Post