CVE-2019-15975

🗓️ 06 Jan 2020 07:40:18Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 106 Views🌐 WEB

Cisco DCNM multiple authentication vulnerabilities, allows remote attacker to bypass authentication

Reporter	Title	Published	Views	Family All 25
0day.today	Cisco Data Center Network Manager 11.2 - Remote Code Execution Exploit	6 Feb 202000:00	–	zdt
BDU FSTEC	The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a attacker to perform arbitrary actions on the vulnerable device.	29 Jan 202000:00	–	bdu_fstec
Circl	CVE-2019-15975	6 Feb 202000:00	–	circl
Cisco	Cisco Data Center Network Manager Authentication Bypass Vulnerabilities	2 Jan 202016:00	–	cisco
Tenable Nessus	Cisco Data Center Network Manager < 11.3(1) Multiple Vulnerabilities	9 Jan 202000:00	–	nessus
CNVD	Cisco Data Center Network Manager REST API Authentication Bypass Vulnerability	3 Jan 202000:00	–	cnvd
Cvelist	CVE-2019-15975 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities	6 Jan 202007:40	–	cvelist
Exploit DB	Cisco Data Center Network Manager 11.2 - Remote Code Execution	6 Feb 202000:00	–	exploitdb
exploitpack	Cisco Data Center Network Manager 11.2 - Remote Code Execution	6 Feb 202000:00	–	exploitpack
Metasploit	Cisco DCNM auth bypass	24 Jun 202117:43	–	metasploit

NVD

Node

cisco data_center_network_managerRange<11.3(1)

[
  {
    "product": "Cisco Data Center Network Manager",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/156238/Cisco-Data-Center-Network-Manager-11.2-Remote-Code-Execution.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass

Parameter	Position	Path	Description	CWE
userName	request body	/fm/fmrest/dbadmin/addUser	Auth bypass to add an admin user in Cisco DCNM via the fmrest addUser endpoint (unauthenticated/admin action).	CWE-798
password	request body	/fm/fmrest/dbadmin/addUser	Auth bypass to add an admin user in Cisco DCNM via the fmrest addUser endpoint (unauthenticated/admin action).	CWE-798
roleName	request body	/fm/fmrest/dbadmin/addUser	Auth bypass to add an admin user in Cisco DCNM via the fmrest addUser endpoint (unauthenticated/admin action).	CWE-798

17 Jun 2026 02:21Current

9.9High risk

Vulners AI Score9.9

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.85649

SSVC

CWE-798