CVE-2020-3377: A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary…

PriorityP357high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.02%

59.3th percentile

A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted arguments to a specific field within the application. A successful exploit could allow the attacker to run commands as the administrator on the DCNM.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_data_center_network_manager	—	—
cisco	data_center_network_manager	—	—
cisco	data_center_network_manager	—	—
cisco	data_center_network_manager	—	—
cisco	data_center_network_manager	—	—
cisco	data_center_network_manager	—	—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

vendor_cisco6.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.