Cisco Data Center Network Manager REST API Session Token hard-coded credentials

Summaryinfo

A vulnerability was found in Cisco Data Center Network Manager. It has been declared as critical. This vulnerability affects unknown code of the component REST API. The manipulation as part of Session Token results in hard-coded credentials. This vulnerability was named CVE-2020-3382. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Data Center Network Manager (version now known). Affected is some unknown processing of the component REST API. The manipulation as part of a Session Token leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.

The weakness was presented 07/31/2020 as cisco-sa-dcnm-bypass-dyEejUMs as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2020-3382 since 12/12/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Upgrading eliminates this vulnerability.

See VDB-159232, VDB-159231, VDB-159230 and VDB-159229 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Data Center Network Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion