Use of hard-coded credentials in Cisco Data Center Network Manager - CVE-2019-15976

Vulnerability details

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists in the SOAP API endpoint within the validation of SSO tokens of SOAP packets due to a static encryption key is shared between installations. A remote unauthenticated attacker can access the affected system using the static key to craft a valid session token and perform arbitrary actions through the SOAP API with administrative privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2019-15976

Links to Public Exploits and PoC-codes

• Exploit #5782 - Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection (June 17, 2021)
• Exploit #4741 - Cisco Data Center Network Manager HostEnclHandler getVmHostData SQL Injection Remote Code Execution Vulnerability (October 27, 2020)

External References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass
• https://www.zerodayinitiative.com/advisories/ZDI-20-008/

Related Security Bulletins

• Multiple vulnerabilities in Cisco Data Center Network Manager
• Multiple vulnerabilities in Dell MDS-DCNM