CVE-2019-15975
CRITICALCisco Data Center Network Manager < 11.3(1) - Unauthenticated Remote Code Execution via Authentication Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-15975.
PoCs published by mr_me, MR_ME, including Metasploit module auxiliary/admin/networking/cisco_dcnm_auth_bypass.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in Cisco Data Center Network Manager (DCNM) via the SanWS importTS endpoint to achieve remote code execution. It bypasses authentication, adds a global admin user, and loads a malicious Java class from an SMB share to establish a reverse shell.
Description
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Exploits (2)
This exploit leverages a command injection vulnerability in Cisco Data Center Network Manager (DCNM) via the SanWS importTS endpoint to achieve remote code execution. It bypasses authentication, adds a global admin user, and loads a malicious Java class from an SMB share to establish a reverse shell.
This Metasploit module exploits an authentication bypass vulnerability in Cisco DCNM by crafting a token using a hardcoded AES key and adding an admin account via session stealing. It requires a recent admin connection to succeed.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H