What’s Vulnerable › Vulnerabilities

CVE-2020-3384: Cisco Data Center Network Manager Command Injection Vulnerability

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-31 · updated 2026-06-17
• Weakness: CWE-184

Description

A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system with the privileges of the logged-in user. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to inject arbitrary commands on the underlying operating system.

Affected products

• Cisco Data Center Network Manager: before 11.4\(1\) — fixed in 11.4\(1\)

How to fix

Upgrade to a fixed version: Cisco Data Center Network Manager 11.4\(1\). Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-rest-inj-BCt8pwAJ
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-rest-inj-BCt8pwAJ

Get alerted when CVE-2020-3384 or the next vulnerability affects your stack