The flaw could allow a remote, unauthenticated attacker to bypass authentication on vulnerable devices.

Cisco is warning of several critical and high-severity flaws in its Data Center Network Manager (DCNM) for managing network platforms and switches.

DCNM is a platform for managing Cisco data centers that run Cisco’s NX-OS — the network operating system used by Cisco’s Nexus-series Ethernet switches and MDS-series Fibre Channel storage area network switches. The flaws exist in the REST API of DCNM — and the most serious of these could allow an unauthenticated, remote attacker to bypass authentication, and ultimately execute arbitrary actions with administrative privileges on a vulnerable device.

The critical flaw (CVE-2020-3382), which was found during internal security testing, rates 9.8 out of 10 on the CVSS scale, making it critical in severity. While the flaw is serious, the Cisco Product Security Incident Response Team said it is not aware of any public announcements or malicious exploits of the vulnerability.

“The vulnerability exists because different installations share a static encryption key,” said Cisco, in a security update on Wednesday. “An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.”

This vulnerability affects all deployment modes of all Cisco DCNM appliances that were installed using .ova or .iso installers, and affects Cisco DCNM software releases 11.0(1), 11.1(1), 11.2(1), and 11.3(1).

“Cisco has confirmed that this vulnerability does not affect Cisco DCNM instances that were installed on customer-provided operating systems using the DCNM installer for Windows or Linux,” said Cisco. “Cisco has also confirmed that this vulnerability does not affect Cisco DCNM software releases 7.x and 10.x.”

Cisco has released software updates that address the vulnerability, though there are no workarounds that address the flaw.

Cisco also patched five high-severity flaws in DCNM, including two command-injection flaws (CVE-2020-3377 and CVE-2020-3384 ) that could allow an authenticated, remote attacker to inject arbitrary commands on affected devices; a path traversal issue (CVE-2020-3383) that could enable an authenticated, remote attacker to conduct directory traversal attacks on vulnerable devices; an improper authorization flaw (CVE-2020-3386), allowing an authenticated, remote attacker with a low-privileged account to bypass authorization on the API of an affected device; and an authentication bypass glitch (CVE-2020-3376) allowing an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on an affected device.

DCNM came in the spotlight earlier this year when three critical vulnerabilities (CVE-2019-15975, CVE-2019-15976, CVE-2019-15977) were discovered in the tool in January. Two critical flaws were also found last year in DCNM, which could allow attackers to take control of impacted systems.

Cisco on Wednesday also patched a critical vulnerability (CVE-2020-3374) in the web-based management interface of its SD-WAN vManage Network Management system (the centralized management platform). This flaw could allow a remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system – but the attacker would need to be authenticated to exploit the flaw.

#vulnerabilities #web security #cisco #critical cisco flaw #cve-2020-3382 #data center network manager #dcnm #fix #patch #rest api #security #vulnerability