CVE-2020-3281 Cisco Digital Network Architecture Center Information Disclosure Vulnerability

Medium 4.3 Published 3 Jun 2020 Updated 15 Nov 2024

Authenticated attackers can view unencrypted credentials in audit logs to gain unauthorized access to network devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3281?

CVE-2020-3281 is a medium-severity vulnerability in Cisco Digital Network Architecture Center (DNA Center), published on 3 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the audit logging component of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. The vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.

Weakness: CWE-532

Which versions are affected by CVE-2020-3281?

It affects 1 product.

Products include Cisco Digital Network Architecture Center.

How do I fix CVE-2020-3281?

No fix has been published for CVE-2020-3281 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3281 being exploited?

There is no known exploitation of CVE-2020-3281 in the wild and no public exploit code.

Sources

Also known as GHSA-hcrf-j785-xgwj.