CVE-2019-1848

Cisco DNA Center (affected software) contains an authentication-bypass flaw due to insufficient access restriction on ports required for system operation. An unauthenticated, adjacent attacker could connect an unauthorized device to the cluster services subnet to reach internal services not harde...

CVE-2018-0271

CVE-2018-0271 is a vulnerability in the API gateway of Cisco DNA Center. The issue stems from a failure to normalize URLs before servicing requests, enabling an unauthenticated, remote attacker to bypass authentication and gain unauthenticated access to critical services, with elevated privileges...

CVE-2020-3391

Cisco DNA Center Information Disclosure (CVE-2020-3391): An authenticated remote attacker could view credentials stored insecurely, by accessing device configuration. Affected product: Cisco DNA Center. Root cause: insecure storage of unencrypted credentials. Impact: potential exposure of credent...

CVE-2018-0222

CVE-2018-0222 affects Cisco DNA Center software prior to Release 1.1.3. The issue stems from undocumented, static credentials for the default administrative account, enabling an unauthenticated, remote attacker to log in and execute arbitrary commands with root privileges. Cisco’s advisory confir...

CVE-2020-3281

CVE-2020-3281 describes an information-disclosure vulnerability in the audit-logging component of Cisco DNA Center. The root cause is storage of certain credentials in unencrypted form, enabling an authenticated, remote attacker to obtain credentials from audit logs. As stated, exploitation could...

CVE-2018-0448

Cisco DNA Center Identity Management service is affected in versions prior to 1.1.4. The issue stems from insufficient restrictions on critical management functions, allowing an unauthenticated, remote attacker to bypass authentication and take full control of identity management functions via a ...

CVE-2019-1675

CVE-2019-1675 affects Cisco Aironet Active Sensor. The issue arises from a default local account with a static password that provides privileges only to reboot the device; an unauthenticated, remote attacker can guess the account name/password to access the CLI and reboot the sensor, potentially ...