Actively exploited · Published Apr 3, 2015 · Assigned by cisco

CVE-2015-0666

High 7.5 Exploited

In plain English

A high-severity path traversal in Prime Data Center Network Manager (DCNM) from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 40.4% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)40.4%top 1.3% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

1032009 vdb-entry, x_refsource_SECTRACK
20150401 Cisco Prime Data Center Network Manager File Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0666 government-resource