Vulnerability identifier: #VU48550

Vulnerability risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26079

CWE-ID: CWE-256

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco IoT Field Network Director
Web applications / Remote management & hosting panels

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote user to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A remote administrator can view contents of the configuration file and gain access to passwords for 3rd party integration.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco IoT Field Network Director: 4.6

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-PWH-yCA6M7p

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.