CVE-2020-26075: A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.57%

72.5th percentile

A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_iot_field_network_director	—	—
cisco	iot_field_network_director	< 4.6.1	4.6.1
cisco	iot_field_network_rest	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Exploit vector targets the REST API of Cisco IoT Field Network Director (FND); monitor for crafted/malformed API requests to the FND REST API endpoint that may indicate SQL injection attempts (CWE-89) ↗
→Requires authenticated access; investigate anomalous authenticated REST API activity against Cisco FND, particularly requests with SQL metacharacters or unexpected query structures in API parameters ↗

·No workarounds are available for this vulnerability; patching is the only remediation. Track Cisco Bug ID CSCvt45225 for patch status. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv3.06.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

vendor_cisco6.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.