Vulnslist

find the latest Cisco vulnerabilities

Cisco Prime Data Center Network Manager Remote Command Execution Vulnerability

cisco-sa-20121031-dcnm · Critical · Published · Updated

Cisco Prime Data Center Network Manager (DCNM) contains a remote command execution vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands on the computer that is running the Cisco Prime DCNM application.Cisco has released software updates that address this vulnerability.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121031-dcnmNote: After this advisory was initially published, it was found that in addition to the DCNM SAN server component that is part of the DCNM solution, the DCNM LAN server is also affected by the same vulnerability. This advisory has been updated to revision 2.0 to indicate that the DCNM LAN server component is also vulnerable, to provide the Cisco bug ID that tracks the vulnerability in the DCNM LAN server component, and to update fixed software information.

Cisco advisory ·CSAF JSON

Workarounds

Because RMI transactions start with a connection to the RMI registry port, which by default is TCP port 1099 or 9099 depending on the Cisco Prime DCNM version, allowing only legitimate devices to connect to the RMI registry port can mitigate this vulnerability.

Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Identifying and Mitigating Exploitation of the Cisco Prime Data Center Network Manager Remote Command Execution Vulnerability," which is available at the following link:

https://sec.cloudapps.cisco.com/security/center/viewAMBAlert.x?alertId=27268

CVEsCVE-2012-5417
Cisco Bug IDsCSCtz44924, CSCua31204
CVSS ScoreBase 10.0
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C
Product Names From Source
Cisco Prime Data Center Network Manager (DCNM)

Related Products

Product CVE Evidence