CVE-2019-1622mediumCWE-284

CVE-2019-1622: medium-severity vulnerability in Cisco Data Center Network Manager

Cisco Data Center Network Manager Information Disclosure Vulnerability

Published · Updated

70Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.3epss 79%
from disclosure to weapon68 days
Published on NVDJun 27
1st PoC+68d
metasploitJun 26
exploitation probability
79%top 1% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download log files and diagnostic information from the affected device.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Cisco · Cisco Data Center Network Manager
public PoCs found — 3✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47347cve_referencepacketstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Data Center Network Manager

In the same product, most dangerous first.

CVE-2019-15975CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 96.5%CVE-2019-15976CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 92.8%CVE-2019-1620CRITICALCisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution VulnerabilityEPSS 83.8%CVE-2019-1619CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilityEPSS 82.8%CVE-2019-15980HIGHCisco Data Center Network Manager Path Traversal VulnerabilitiesEPSS 50.0%CVE-2019-15984HIGHCisco Data Center Network Manager SQL Injection VulnerabilitiesEPSS 46.9%
References
http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2019/Jul/7https://seclists.org/bugtraq/2019/Jul/11https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-infodisclhttp://www.securityfocus.com/bid/108908