CVE-2020-3391 Cisco Digital Network Architecture Center Information Disclosure Vulnerability

Medium 6.5 Published 2 Jul 2020 Updated 15 Nov 2024

Authenticated attackers can view unencrypted credentials in Cisco DNA Center, enabling unauthorized access to manage network devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3391?

CVE-2020-3391 is a medium-severity vulnerability in Cisco Digital Network Architecture Center (DNA Center), published on 2 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. The vulnerability is due to insecure storage of certain unencrypted credentials on an affected device. An attacker could exploit this vulnerability by viewing the network device configuration and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.

Weakness: CWE-522, CWE-200

Which versions are affected by CVE-2020-3391?

It affects 1 product.

Products include Cisco Digital Network Architecture Center.

How do I fix CVE-2020-3391?

No fix has been published for CVE-2020-3391 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3391 being exploited?

There is no known exploitation of CVE-2020-3391 in the wild and no public exploit code.

Sources

Also known as GHSA-jhv6-f622-9cgv.