CVE-2020-3392: Cisco IoT Field Network Director Missing API Authentication Vulnerability
First published: Wed Nov 18 2020(Updated: )
A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this vulnerability by sending API requests to an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system, including information about the devices that the system manages, without authentication.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IoT Field Network Director | <4.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3392?
CVE-2020-3392 has a high severity rating due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2020-3392?
To fix CVE-2020-3392, upgrade Cisco IoT Field Network Director to version 4.6.1 or later.
What systems are affected by CVE-2020-3392?
CVE-2020-3392 affects Cisco IoT Field Network Director versions prior to 4.6.1.
Can an attacker exploit CVE-2020-3392 remotely?
Yes, an attacker can exploit CVE-2020-3392 remotely without authentication.
What information can be accessed through CVE-2020-3392?
An attacker exploiting CVE-2020-3392 can view sensitive information stored on the affected system.
- agent/softwarecombine
- agent/type
- agent/references
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco iot field network director