What is the severity of CVE-2020-26079?

CVE-2020-26079 has been rated as a medium severity vulnerability.

How do I fix CVE-2020-26079?

To mitigate CVE-2020-26079, users should upgrade Cisco IoT Field Network Director to version 4.6.1 or later.

Who is affected by CVE-2020-26079?

CVE-2020-26079 affects users of Cisco IoT Field Network Director versions prior to 4.6.1.

What type of vulnerability is CVE-2020-26079?

CVE-2020-26079 is a credential disclosure vulnerability due to insufficient protection of user passwords.

Can an attacker exploit CVE-2020-26079 remotely?

Yes, an authenticated remote attacker can exploit CVE-2020-26079 to obtain user password hashes.

Vulnerability/
CVE-2020-26079

medium

4.9

CWE

522 256

18/11/2020

13/11/2024

CVE-2020-26079: Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability

First published: Wed Nov 18 2020(Updated: )

A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by logging in as an administrative user and crafting a call for user information. A successful exploit could allow the attacker to obtain hashes of user passwords on an affected device.

Credit: ykramarz@cisco.com

Affected Software	Affected Version	How to fix
Cisco IoT Field Network Director	<4.6.1

Never miss a vulnerability like this again

Reference Links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-PWH-yCA6M7p

Frequently Asked Questions

What is the severity of CVE-2020-26079?
CVE-2020-26079 has been rated as a medium severity vulnerability.
How do I fix CVE-2020-26079?
To mitigate CVE-2020-26079, users should upgrade Cisco IoT Field Network Director to version 4.6.1 or later.
Who is affected by CVE-2020-26079?
CVE-2020-26079 affects users of Cisco IoT Field Network Director versions prior to 4.6.1.
What type of vulnerability is CVE-2020-26079?
CVE-2020-26079 is a credential disclosure vulnerability due to insufficient protection of user passwords.
Can an attacker exploit CVE-2020-26079 remotely?
Yes, an authenticated remote attacker can exploit CVE-2020-26079 to obtain user password hashes.

agent/weakness
agent/type
agent/softwarecombine
agent/severity
agent/title
agent/author
agent/references
agent/description
agent/event
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/cisco
canonical/cisco iot field network director

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2020-26079?
CVE-2020-26079 has been rated as a medium severity vulnerability.
How do I fix CVE-2020-26079?
To mitigate CVE-2020-26079, users should upgrade Cisco IoT Field Network Director to version 4.6.1 or later.
Who is affected by CVE-2020-26079?
CVE-2020-26079 affects users of Cisco IoT Field Network Director versions prior to 4.6.1.
What type of vulnerability is CVE-2020-26079?
CVE-2020-26079 is a credential disclosure vulnerability due to insufficient protection of user passwords.
Can an attacker exploit CVE-2020-26079 remotely?
Yes, an authenticated remote attacker can exploit CVE-2020-26079 to obtain user password hashes.