CVE-2020-3538
📋 TL;DR
This vulnerability in Cisco Data Center Network Manager (DCNM) allows authenticated remote attackers to perform path traversal attacks via a specific REST API endpoint. Attackers can overwrite or list arbitrary files on affected devices. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- Cisco Data Center Network Manager (DCNM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through overwriting critical system files, configuration tampering, or sensitive data exfiltration.
Likely Case
Unauthorized file access leading to information disclosure, configuration manipulation, or limited system disruption.
If Mitigated
Minimal impact with proper network segmentation, strong authentication controls, and monitoring in place.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.5(1) and later
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-pa-trav-bMdfSTTq
Restart Required: Yes
Instructions:
1. Download DCNM version 11.5(1) or later from Cisco. 2. Backup current configuration. 3. Install the update following Cisco's upgrade guide. 4. Restart the DCNM service.
🧯 If You Can't Patch
- Restrict network access to DCNM management interfaces to trusted IPs only.
- Implement strict authentication controls and monitor for unusual API access patterns.
🔍 How to Verify
Check if Vulnerable:
Check DCNM version via web interface or CLI. If version is below 11.5(1), system is vulnerable.Check Version:
From DCNM CLI: show version | include VersionVerify Fix Applied:
Verify DCNM version is 11.5(1) or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to REST API endpoints with path traversal patterns (../ sequences)
- Multiple failed authentication attempts followed by successful API access
Network Indicators:
- HTTP requests containing path traversal sequences to DCNM management interfaces
SIEM Query:
source="dcnm" AND (http_uri="*../*" OR http_uri="*..\\*" OR http_uri="*%2e%2e%2f*")🔗 References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-pa-trav-bMdfSTTq
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb
