CVE-2013-5486: Cisco Prime DCNM path traversal in processImageSave.jsp enables file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote file write that can be escalated to command execution, with a public exploit and very high EPSS probability.

What it is

Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) contains a directory traversal flaw in processImageSave.jsp where the chartid parameter is not properly validated. A remote, unauthenticated attacker can write arbitrary files to the server, which can be chained with JBoss autodeploy to execute arbitrary commands.

Impact

An attacker can write files anywhere the DCNM server process can reach, and by abusing JBoss autodeploy can turn that file write into remote code execution with the privileges of the application server.

Attack surface

Reachable over the network via HTTP requests to processImageSave.jsp; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

A public exploit exists (Exploit-DB 30008) and EPSS is very high at 0.75962 (99.5th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Cisco Prime DCNM to 6.2(1) or later, which is the fixed release per the vendor advisory.
• If immediate upgrade is not possible, restrict network access to the DCNM management interface to trusted administrative networks only.
• Disable or restrict JBoss autodeploy on the DCNM host to break the file-write-to-code-execution chain.
• Monitor the DCNM server for unexpected files or deployments appearing in JBoss deployment directories.

Detection

• Inspect HTTP logs for requests to processImageSave.jsp with chartid values containing path traversal sequences such as ../ or encoded variants.
• Alert on new or modified files in JBoss autodeploy or deployment directories on DCNM hosts.
• Monitor for unexpected process creation or outbound connections originating from the DCNM server following file writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.