CVE-2019-1620

CRITICAL

Cisco Data Center Network Manager - Unauthenticated Arbitrary File Write and Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2019-1620. Includes Metasploit module exploits/multi/http/cisco_dcnm_upload_2019.

AI-analyzed exploit summary This Metasploit module exploits CVE-2019-1620, an unauthenticated remote code execution vulnerability in Cisco Data Center Network Manager (DCNM). It chains CVE-2019-1619 (authentication bypass) and CVE-2019-1622 (information disclosure) to upload a malicious WAR file to the Tomcat webapps directory, achieving RCE as root.

Description

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could exploit this vulnerability by uploading specially crafted data to the affected device. A successful exploit could allow the attacker to write arbitrary files on the filesystem and execute code with root privileges on the affected device.

Exploits (2)

metasploit WORKING POC EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cisco_dcnm_upload_2019.rb

This Metasploit module exploits CVE-2019-1620, an unauthenticated remote code execution vulnerability in Cisco Data Center Network Manager (DCNM). It chains CVE-2019-1619 (authentication bypass) and CVE-2019-1622 (information disclosure) to upload a malicious WAR file to the Tomcat webapps directory, achieving RCE as root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Cisco Data Center Network Manager (DCNM) versions 10.4(2) and below, 11.0(1), 11.1(1)
No auth needed
Prerequisites: Network access to the DCNM interface · Tomcat webapps directory writable via file upload servlet
devstral-2 · analyzed Apr 30, 2026 Full analysis →
exploitdb WORKING POC
rubyremotejava
https://www.exploit-db.com/exploits/47347

This Metasploit module exploits CVE-2019-1620, a file upload vulnerability in Cisco Data Center Network Manager (DCNM), by chaining it with CVE-2019-1619 (authentication bypass) and CVE-2019-1622 (information disclosure) to achieve unauthenticated remote code execution as root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Cisco Data Center Network Manager (DCNM) versions 10.4(2) and below, 11.0(1), 11.1(1)
No auth needed
Prerequisites: Network access to the DCNM interface · Apache Tomcat webapps directory writable via file upload servlet
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/108906
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Jul/11
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Jul/7

Scores

CVSS v3 9.8
EPSS 0.8562
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-22 CWE-264
Status published
Products (1)
cisco/data_center_network_manager 11.0\(1\)
Published Jun 27, 2019
Tracked Since Feb 18, 2026