Use of hard-coded credentials in Cisco Data Center Network Manager - CVE-2019-15975

Vulnerability details

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists in the REST API endpoint within the processing of the dbadmin/addUser functionality due to a static encryption key is shared between installations. A remote unauthenticated attacker can access the affected system using the static key to craft a valid session token and perform arbitrary actions through the REST API with administrative privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2019-15975

Links to Public Exploits and PoC-codes

• Exploit #6467 - Cisco DCNM auth bypass (June 24, 2021)
• Exploit #5784 - Cisco Data Center Network Manager 11.2 - Remote Code Execution (June 17, 2021)
• Exploit #4739 - Cisco Data Center Network Manager SanWS importTS Command Injection Remote Code Execution Vulnerability (October 27, 2020)

External References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass
• https://www.zerodayinitiative.com/advisories/ZDI-20-003/

Related Security Bulletins

• Multiple vulnerabilities in Cisco Data Center Network Manager
• Multiple vulnerabilities in Dell MDS-DCNM