CVE-2020-3377: Cisco Data Center Network Manager Command Injection Vulnerability
First published: Fri Jul 31 2020(Updated: )
A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted arguments to a specific field within the application. A successful exploit could allow the attacker to run commands as the administrator on the DCNM.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Data Center Network Manager | =11.0\(1\) | |
| Cisco Data Center Network Manager | =11.1\(1\) | |
| Cisco Data Center Network Manager | =11.2\(1\) | |
| Cisco Data Center Network Manager | =11.3\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-3377?
CVE-2020-3377 is a vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) that allows an authenticated, remote attacker to inject arbitrary commands on the affected device.
How severe is CVE-2020-3377?
CVE-2020-3377 has a severity score of 8.8, which is considered high.
Which versions of Cisco Data Center Network Manager are affected by CVE-2020-3377?
CVE-2020-3377 affects Cisco Data Center Network Manager versions 11.0(1), 11.1(1), 11.2(1), and 11.3(1).
How can an attacker exploit CVE-2020-3377?
An attacker can exploit CVE-2020-3377 by using insufficiently validated user-supplied input to inject arbitrary commands on the affected device.
What is the Common Weakness Enumeration (CWE) of CVE-2020-3377?
CVE-2020-3377 is classified under CWE-78, which is Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection').
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco data center network manager
- version/cisco data center network manager/11.0\(1\)
- version/cisco data center network manager/11.1\(1\)
- version/cisco data center network manager/11.2\(1\)
- version/cisco data center network manager/11.3\(1\)