Use of hard-coded credentials in Cisco Data Center Network Manager - CVE-2020-3382
Published: July 30, 2020
Vulnerability identifier: #VU32917
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3382
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to different installations share a static encryption key. A remote unauthenticated attacker can use the static key to craft a valid session token and access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cisco Data Center Network Manager
Dell EMC Connectrix DCNM
Dell EMC Connectrix DCNM
How to mitigate CVE-2020-3382
Install updates from vendor's website.
Cisco Data Center Network Manager - update to 11.4.1
Dell EMC Connectrix DCNM - update to 11.4(1)
Dell EMC Connectrix DCNM - update to 11.4(1)