CVE-2020-26072: Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability
First published: Wed Nov 18 2020(Updated: )
A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit this vulnerability by sending SOAP API requests to affected devices for devices that are outside their authorized domain. A successful exploit could allow the attacker to access and modify information on devices that belong to a different domain.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IoT Field Network Director | <4.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-26072?
CVE-2020-26072 is classified as a high severity vulnerability.
How do I fix CVE-2020-26072?
To fix CVE-2020-26072, upgrade Cisco IoT Field Network Director to version 4.6.1 or later.
Who is affected by CVE-2020-26072?
CVE-2020-26072 affects users of Cisco IoT Field Network Director versions prior to 4.6.1.
What type of attack does CVE-2020-26072 facilitate?
CVE-2020-26072 allows an authenticated remote attacker to access and modify information on devices belonging to a different domain.
What component of Cisco IoT Field Network Director is vulnerable in CVE-2020-26072?
The vulnerability in CVE-2020-26072 is due to insufficient authorization in the SOAP API of Cisco IoT Field Network Director.
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/severity
- agent/title
- agent/author
- agent/references
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco iot field network director