Design/Logic Flaw

A vulnerability in the user management functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could...

CVE-2020-3531

Cisco IoT Field Network Director (FND) is affected by an unauthenticated REST API vulnerability. The REST API fails to properly authenticate calls, enabling an attacker to obtain a CSRF token and perform REST requests that read, alter, or drop data in the back‑end database. Impact is high (unauth...

CVE-2020-26081

Cisco IoT Field Network Director (FND) web UI is affected by CVE-2020-26081, a cross-site scripting vulnerability due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user to click a crafted link to execute arbitrary script in the interface or ac...

CVE-2020-26080

CVE-2020-26080 affects Cisco IoT Field Network Director (FND). The issue arises from improper domain access control in the user management feature, allowing an authenticated, remote attacker to manipulate JSON payloads to manage user information for users in different domains on an affected syste...

CVE-2020-26079

Cisco IoT Field Network Director (FND) web UI contains a credentials protection flaw (CVE-2020-26079) that allows an authenticated admin to retrieve password hashes from an affected device due to insufficient protection of user credentials. Affected product/version details are noted in multiple s...

CVE-2020-26078

The CVE-2020-26078 issue affects Cisco IoT Field Network Director (FND). Affected products: FND versions prior to 4.6.1. Root cause: insufficient file system protections allowing an authenticated, remote attacker to overwrite files via crafted API requests. Impact: potential file overwrites on th...

CVE-2020-26077 Cisco IoT Field Network Director Improper Access Control Vulnerability

A vulnerability in the access control functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to view lists of users from different domains that are configured on an affected system. The vulnerability is due to improper access control. An attacker could...

CVE-2020-26077

CVE-2020-26077 concerns Cisco IoT Field Network Director (FND) and describes an access-control error that could let an authenticated, remote attacker view user lists from different domains. The flaw arises when an API request alters the domain for a requested user list, enabling cross-domain expo...

CVE-2020-26076

Cisco IoT Field Network Director (FND) information-disclosure vulnerability (CVE-2020-26076) allows an unauthenticated remote attacker to view sensitive database information by sending crafted curl commands. Affected releases before Cisco’s advisory fix; Cisco has released software updates to add...

CVE-2020-26075

Cisco IoT Field Network Director (FND) REST API suffers from insufficient input validation, enabling authenticated remote attackers to craft malicious API requests and potentially access the device’s back-end database (SQL‑injection-like effect). Affected component is the REST API of FND; impact ...

CVE-2020-26072

Cisco IoT Field Network Director (FND) SOAP API has an authorization bypass vulnerability (CVE-2020-26072). An authenticated, remote attacker can send SOAP requests to devices outside their authorized domain, due to insufficient SOAP API authorization. Impact: attacker could access and modify inf...

Cisco IoT Field Network Director Improper Domain Access Control Vulnerability

A vulnerability in the user management functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could...

Cisco IoT Field Network Director Improper Access Control Vulnerability

A vulnerability in the access control functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to view lists of users from different domains that are configured on an affected system. The vulnerability is due to improper access control. An attacker could...

CVE-2020-26075: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. ...

CVE-2020-3392: Missing Authentication for Critical Function

A vulnerability in the API of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this...

CVE-2020-3531: Missing Authentication for Critical Function

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could...

CVE-2020-26080: Improper Access Control

A vulnerability in the user management functionality of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could...

Xxe

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director IoT-FND Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External...

CVE-2019-1698 Cisco IoT Field Network Director XML External Entity Vulnerability

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director IoT-FND Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External...

CVE-2019-1698: Improper Restriction of XML External Entity Reference

A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director IoT-FND Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External...