CVE-2020-26075: Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability
First published: Wed Nov 18 2020(Updated: )
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IoT Field Network Director | <4.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-26075?
CVE-2020-26075 is rated as a high severity vulnerability due to its potential to expose sensitive data.
How do I fix CVE-2020-26075?
To fix CVE-2020-26075, upgrade Cisco IoT Field Network Director to version 4.6.1 or later.
Who is affected by CVE-2020-26075?
CVE-2020-26075 affects users of Cisco IoT Field Network Director versions prior to 4.6.1.
What type of attacks can exploit CVE-2020-26075?
CVE-2020-26075 can be exploited by an authenticated, remote attacker to gain unauthorized access to the back-end database.
What is the cause of CVE-2020-26075?
CVE-2020-26075 is caused by insufficient input validation in the REST API requests of Cisco IoT Field Network Director.
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/severity
- agent/title
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco iot field network director