ID
VAR-202011-1016
CVE
CVE-2020-3531
TITLE
Cisco IoT Field Network Director Vulnerability regarding lack of authentication for critical features in
Trust: 0.8
DESCRIPTION
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could exploit this vulnerability by obtaining a cross-site request forgery (CSRF) token and then using the token with REST API requests. A successful exploit could allow the attacker to access the back-end database of the affected device and read, alter, or drop information. Cisco IoT Field Network Director (IoT-FND) is an end-to-end Internet of Things management system from Cisco in the United States. The system has functions such as equipment management, asset tracking and smart metering
Trust: 2.79
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | cisco | model: | iot field network director | scope: | lt | version: | 4.6.1 | Trust: 1.6 |
| vendor: | シスコシステムズ | model: | cisco iot field network director | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-306 | Trust: 1.1 |
| problemtype: | Lack of authentication for important features (CWE-306) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
access control error
Trust: 0.6
PATCH
| title: | cisco-sa-FND-BCK-GHkPNZ5F | url: | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F | Trust: 0.8 |
| title: | Patch for Cisco IoT Field Network Director Privilege Escalation Vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/241024 | Trust: 0.6 |
| title: | Cisco IoT Field Network Director Fixes for access control error vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134783 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-3531 | Trust: 3.1 |
| db: | JVNDB | id: | JVNDB-2020-013761 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2020-66206 | Trust: 0.7 |
| db: | AUSCERT | id: | ESB-2020.4111 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202011-1608 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-181656 | Trust: 0.1 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-3531 | Trust: 2.0 |
| url: | https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-fnd-bck-ghkpnz5f | Trust: 1.7 |
| url: | https://www.auscert.org.au/bulletins/esb-2020.4111/ | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2020-66206 |
| db: | VULHUB | id: | VHN-181656 |
| db: | JVNDB | id: | JVNDB-2020-013761 |
| db: | CNNVD | id: | CNNVD-202011-1608 |
| db: | NVD | id: | CVE-2020-3531 |
LAST UPDATE DATE
2024-11-23T21:51:12.862000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2020-66206 | date: | 2020-11-24T00:00:00 |
| db: | VULHUB | id: | VHN-181656 | date: | 2020-12-02T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-013761 | date: | 2021-07-13T07:56:00 |
| db: | CNNVD | id: | CNNVD-202011-1608 | date: | 2020-12-03T00:00:00 |
| db: | NVD | id: | CVE-2020-3531 | date: | 2024-11-21T05:31:15.800 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2020-66206 | date: | 2020-11-24T00:00:00 |
| db: | VULHUB | id: | VHN-181656 | date: | 2020-11-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-013761 | date: | 2021-07-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-202011-1608 | date: | 2020-11-18T00:00:00 |
| db: | NVD | id: | CVE-2020-3531 | date: | 2020-11-18T19:15:12.773 |