Threat Investigation
Request a demo

CVE-2020-3531

Critical

Description

A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could exploit this vulnerability by obtaining a cross-site request forgery (CSRF) token and then using the token with REST API requests. A successful exploit could allow the attacker to access the back-end database of the affected device and read, alter, or drop information.

SeverityCritical
CVSS9.8
Exploit probability—
ProductCisco Iot Field Network Director
PublishedNov 18, 2020
First seenNov 18, 2020
Weakness typeCWE-306Missing authentication for critical function

How to fix

Update
  • cisco iot_field_network_director4.6.1 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
cisco iot_field_network_directorv < 4.6.14.6.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.