CVE-2019-15975

🗓️ 06 Jan 2020 07:40:18Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 148 Views🌐 WEB

Cisco DCNM multiple authentication vulnerabilities, allows remote attacker to bypass authentication

Reporter	Title	Published	Views	Family All 27
zdt	Cisco Data Center Network Manager 11.2 - Remote Code Execution Exploit	6 Feb 202000:00	–	zdt
BDU FSTEC	The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a attacker to perform arbitrary actions on the vulnerable device.	29 Jan 202000:00	–	bdu_fstec
Circl	CVE-2019-15975	6 Feb 202000:00	–	circl
Cisco	Cisco Data Center Network Manager Authentication Bypass Vulnerabilities	2 Jan 202016:00	–	cisco
Tenable Nessus	Cisco Data Center Network Manager < 11.3(1) Multiple Vulnerabilities	9 Jan 202000:00	–	nessus
CNVD	Cisco Data Center Network Manager REST API Authentication Bypass Vulnerability	3 Jan 202000:00	–	cnvd
Cvelist	CVE-2019-15975 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities	6 Jan 202007:40	–	cvelist
Exploit DB	Cisco Data Center Network Manager 11.2 - Remote Code Execution	6 Feb 202000:00	–	exploitdb
exploitpack	Cisco Data Center Network Manager 11.2 - Remote Code Execution	6 Feb 202000:00	–	exploitpack
HPE Security Bulletins	HPESBST03980 rev.1 - HPE StoreFabric C-series Switches with Cisco Prime Data Center Network Manager (DCNM), Remote Authentication Bypass	28 Feb 202000:00	–	hpe

NVD

Node

cisco data_center_network_managerRange<11.3(1)

[
  {
    "product": "Cisco Data Center Network Manager",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/156238/Cisco-Data-Center-Network-Manager-11.2-Remote-Code-Execution.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass

Parameter	Position	Path	Description	CWE
userName	request body	/fm/fmrest/dbadmin/addUser	Cisco DCNM authentication bypass via adding an admin account using POST to /fm/fmrest/dbadmin/addUser with an afw-token header.	CWE-798
password	request body	/fm/fmrest/dbadmin/addUser	Cisco DCNM authentication bypass via adding an admin account using POST to /fm/fmrest/dbadmin/addUser with an afw-token header.	CWE-798
roleName	request body	/fm/fmrest/dbadmin/addUser	Cisco DCNM authentication bypass via adding an admin account using POST to /fm/fmrest/dbadmin/addUser with an afw-token header.	CWE-798

17 Jun 2026 02:21Current

9.9Critical risk

Vulners AI Score9.9

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.96455

SSVC

CWE-798