Cisco Data Center Network Manager Authentication Bypass Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.
Summary
A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on an affected device. The vulnerability is due to a failure in the software to perform proper authentication. An attacker could exploit this vulnerability by browsing to one of the hosted URLs in Cisco DCNM. A successful exploit could allow the attacker to interact with and use certain functions within the Cisco DCNM.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Data Center Network Manager | all versions | — | No fix listed | CNA |
- Cisco Data Center Network Manager VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:data_center_network_manager:11.1\(1\):*:*:*:*:*:*:* | 11.1(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:data_center_network_manager:11.2\(1\):*:*:*:*:*:*:* | 11.2(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:data_center_network_manager:11.3\(1\):*:*:*:*:*:*:* | 11.3(1) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:data_center_network_manager:11.1\(1\):*:*:*:*:*:*:* Versions 11.1(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:data_center_network_manager:11.2\(1\):*:*:*:*:*:*:* Versions 11.2(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:data_center_network_manager:11.3\(1\):*:*:*:*:*:*:* Versions 11.3(1) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-3376
- 2026-10-03 Alias added: GHSA-x97g-525f-hjwr
References
More Cisco Data Center Network Manager vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12015 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities CVSS 3.1CRITICAL 9.8
- TI-2019-12016 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities CVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-01247 Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2019-01246 Cisco Data Center Network Manager Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-3376 · CVE Program
- CVE-2020-3376 · NVD
- FIRST EPSS
- GHSA-x97g-525f-hjwr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences