Cisco DNA Center Authentication Bypass Vulnerability (Cisco Cisco Digital Network Architecture Center (DNA Center))
En bref
- Source
- NVD
- EPSS
- EPSS 0.73 % · centile 54 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Modified
Description
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services. The vulnerability is due to insufficient access restriction to ports necessary for system operation. An attacker could exploit this vulnerability by connecting an unauthorized network device to the subnet designated for cluster services. A successful exploit could allow an attacker to reach internal services that are not hardened for external access.
Faiblesses (CWE)
- CWE-668 — Exposition d'une ressource à la mauvaise sphère
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.3 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | cisco |
| CVSS 3.0 | CRITICAL 9.3 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.0 | CRITICAL 9.3 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.8 | AV:A/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-10405
- GCVE · GCVE-0-2019-1848
Avis du CERT-FR
- CERTFR-2019-AVI-284 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:cisco:digital_network_architecture_center:*:*:*:*:*:*:*:*< 1.3
Produits affectés
| Produit | Versions |
|---|---|
| Cisco · Cisco Digital Network Architecture Center (DNA Center) | affected unspecified < 1.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |