CVE-2019-15976: Cisco DCNM authentication bypass via hard-coded credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with unauthenticated remote administrative bypass and a public exploit reference, though not in KEV.

What it is

Cisco Data Center Network Manager contains multiple authentication mechanism flaws, mapped to CWE-798 hard-coded credentials, that let an unauthenticated remote attacker bypass authentication. Because the bypass yields administrative privileges, it exposes full control of the DCNM management plane. The record does not specify which DCNM versions are affected beyond the advisory reference.

Impact

An attacker gains administrative access to DCNM without valid credentials, allowing arbitrary administrative actions on the affected device. That can extend to managing or reconfiguring the data center network DCNM controls.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not detail the specific endpoint or protocol used.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.928 (99.8th percentile), and a public exploit reference (Packet Storm, tagged Exploit) exists, indicating active interest and likely weaponization.

What to do

• Apply the Cisco security advisory cisco-sa-20200102-dcnm-auth-bypass patch or fixed DCNM release; patch is the primary action.
• Restrict network access to DCNM management interfaces to trusted administrative networks only.
• Rotate any credentials or keys that may be exposed by the hard-coded credential flaw.
• Monitor DCNM logs for unexpected administrative logins or configuration changes.
• If patching is delayed, consider isolating DCNM from untrusted networks.

Detection

• Alert on DCNM authentication events that succeed without a corresponding valid credential or from unexpected source IPs.
• Monitor for administrative actions or configuration changes originating from unauthenticated or anomalous sessions.
• Hunt for exploit traffic matching the public Packet Storm SQL injection/auth bypass reference against DCNM endpoints.
• Review DCNM access logs for requests to authentication endpoints from external or non-admin networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.