Cisco plugs critical security holes in Data Center Network Manager

Cisco has plugged four security holes in its Data Center Network Manager, two of which critical (have a 9.8 CVSS score).

About Cisco Data Center Network Manager

Cisco Data Center Network Manager (DCNM) is a management solution data centers, “for all NX-OS-enabled deployments, spanning new fabric architectures, IP Fabric for Media, and storage networking deployments for the Cisco Nexus-powered data center.”

It provides management, control, automation, monitoring, visualization, and troubleshooting across Cisco Nexus and Cisco Multilayer Distributed Switching (MDS) solutions.

About the vulnerabilities

Four flaws have been fixed (no workarounds are available).

All have been discovered and reported by security researcher Pedro Ribeiro, and none are known to be or have been exploited in the wild.

All have been found in the web-based management interface of the DCNM solution, and all can be exploited by unauthenticated, remote attackers.

CVE-2019-1620 could allow the attacker to upload arbitrary files on an affected device, to write arbitrary files on the filesystem and execute code with root privileges on the affected device.

CVE-2019-1619 could allow the attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.

CVE-2019-1621 could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.

CVE-2019-1622 could allow the attacker to download log files and diagnostic information from the affected device (i.e., potentially sensitive information).

But while the first three have been fixed in Release 11.2(1) of the solution, the advisory for the last one requires users to log into Cisco’s Security portal to view the list of vulnerable products and information about fixed software releases.

Users are advised to consult the advisories and update the software.