Cisco Data Center Network Manager vulnerabilities

CVE-2025-20163 [HIGH] CWE-322 CVE-2025-20163: A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could al A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH conne

CVE-2018-0464 [HIGH] CWE-22 CVE-2018-0464: A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote a A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by send

CVE-2020-3112 [HIGH] CWE-264 CVE-2020-3112: A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the application. The vulnerability is due to insufficient access control validation. An attacker could exploit this vulnerability by authenticating with a low-privilege account and sending a crafted r

CVE-2020-3377 [HIGH] CWE-78 CVE-2020-3377: A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted arguments to a specific

CVE-2020-3538 [HIGH] CWE-20 CVE-2020-3538: A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Soft A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by sending crafted HTTP requests to

CVE-2019-15981 [HIGH] CWE-22 CVE-2019-15981: Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM applicati

CVE-2019-15982 [HIGH] CWE-22 CVE-2019-15982: Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM applicati

CVE-2019-15985 [HIGH] CWE-89 CVE-2019-15985: Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DC Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulner

CVE-2021-1272 [HIGH] CWE-918 CVE-2021-1272: A vulnerability in the session validation feature of Cisco Data Center Network Manager (DCNM) could A vulnerability in the session validation feature of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. This vulnerability is due to insufficient validation of parameters in a specific HTTP request by an attacker.

CVE-2024-20348 [HIGH] CWE-27 CVE-2024-20348: A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this vulnerability through direct web requests to the provision

CVE-2024-20281 [HIGH] CWE-352 CVE-2024-20281: A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashb A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an aff

CVE-2024-20490 [HIGH] CWE-200 CVE-2024-20490: A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Ne A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because HTTP proxy credentials could be recorded in an internal log that is stored in the tech support

CVE-2024-20448 [HIGH] CWE-313 CVE-2024-20448: A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within config only and full backup files. An attacker could exp

CVE-2020-3519 [HIGH] CWE-20 CVE-2020-3519: A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software c A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker could exploit this vulnerability by sending a crafted

CVE-2021-1248 [HIGH] CWE-89 CVE-2021-1248: Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) c Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2020-3114 [HIGH] CWE-352 CVE-2020-3114: A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) co A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker

CVE-2020-3384 [HIGH] CWE-184 CVE-2020-3384: A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could all A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system with the privileges of the logged-in user. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker could exploi

CVE-2018-0440 [HIGH] CWE-264 CVE-2018-0440: A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticat A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by a

CVE-2020-3380 [HIGH] CWE-88 CVE-2020-3380: A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerabi

CVE-2020-3521 [MEDIUM] CWE-20 CVE-2020-3521: A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could al A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker with a low-privileged account could exploit this vulner