Vulnerability record · CVE-2019-15980 · published 6 January 2020
CVE-2019-15980: Cisco DCNM REST/SOAP API path traversal
Cisco · Data Center Network Manager
Cisco Data Center Network Manager contains path traversal flaws in its REST and SOAP API endpoints and Application Framework feature. An attacker who already holds administrative privileges on DCNM can traverse directories on the affected device. Cisco notes the severity is worsened by a simultaneously published DCNM authentication bypass advisory.
Description
Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.2 with high confidentiality, integrity and availability impact, and very high EPSS percentile, though exploitation requires admin privileges.
What it is
Cisco Data Center Network Manager contains path traversal flaws in its REST and SOAP API endpoints and Application Framework feature. An attacker who already holds administrative privileges on DCNM can traverse directories on the affected device. Cisco notes the severity is worsened by a simultaneously published DCNM authentication bypass advisory.
Impact
An authenticated admin-level attacker can read and write files outside the intended directory, potentially exposing sensitive data or altering application files. The CVSS vector shows high confidentiality, integrity and availability impact.
Attack surface
Reachable remotely over the network through the REST and SOAP API endpoints and the Application Framework feature. Exploitation requires administrative privileges on the DCNM application; no user interaction is needed.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.4996 (98.8th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Apply the Cisco DCNM updates from advisory cisco-sa-20200102-dcnm-path-trav.
- Also remediate the simultaneously published DCNM authentication bypass vulnerabilities, since they aggravate this issue.
- Restrict network access to DCNM REST/SOAP API and Application Framework interfaces to trusted management networks.
- Review and minimize accounts holding administrative privileges on DCNM.
- Monitor DCNM file system and application logs for unexpected file access or modification.
Detection
- Alert on path traversal sequences (../, encoded variants) in DCNM REST/SOAP API request logs.
- Monitor for file reads or writes outside expected DCNM application directories.
- Audit administrative account activity on DCNM for anomalous API calls.
- Correlate DCNM API activity with authentication bypass indicators from the companion advisory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-15980 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-15980), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
