Vulnerability · Published Jul 16, 2020 · Assigned by cisco
CVE-2020-3380Cisco Data Center Network Manager Privilege Escalation Vulnerability
High 7.8
In plain English
A high-severity argument injection in Cisco Data Center Network Manager from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by authenticating as the fmserver user and submitting malicious input to a specific command. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Data Center Network Manager | n/a |
Weakness: CWE-88 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- 20200715 Cisco Data Center Network Manager Privilege Escalation Vulnerability vendor-advisory, x_refsource_CISCO