CVE-2019-15984: Cisco DCNM REST and SOAP API SQL Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.2) SQL injection with a public exploit reference and very high EPSS, though exploitation requires administrative privileges on DCNM.

What it is

Cisco Data Center Network Manager (DCNM) contains SQL injection flaws in its REST and SOAP API endpoints, tracked as CWE-89. An authenticated attacker with administrative privileges on the DCNM application can send crafted requests to execute arbitrary SQL commands on the underlying database. The advisory notes severity is worsened by a simultaneously published DCNM authentication bypass issue.

Impact

Successful exploitation lets an attacker run arbitrary SQL against the DCNM database, enabling data theft, modification or deletion, and potentially further compromise of the management platform. The CVSS vector shows high confidentiality, integrity and availability impact.

Attack surface

Reachable remotely over the network through the DCNM REST and SOAP API endpoints (AV:N, AC:L). Exploitation requires high privileges (PR:H) — administrative access to the DCNM application — and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.47 (98.8th percentile), and a public exploit reference exists (Packet Storm, tagged Exploit). No ransomware group usage is documented.

What to do

• Apply the Cisco DCNM fixes from advisory cisco-sa-20200102-dcnm-sql-inject as the first action.
• Also remediate the simultaneously published DCNM authentication bypass vulnerabilities, since they aggravate this issue.
• Restrict network access to DCNM REST and SOAP API endpoints to trusted management networks only.
• Enforce least privilege on DCNM accounts and audit administrative users, since exploitation requires admin rights.
• Monitor and rotate credentials for DCNM administrative accounts.

Detection

• Inspect DCNM REST and SOAP API request logs for SQL metacharacters and injection patterns (quotes, UNION, stacked queries).
• Alert on anomalous or unexpected SQL activity against the DCNM backend database.
• Baseline normal administrative API usage and flag unusual endpoints, volumes or timing from admin accounts.
• Review DCNM admin account activity for signs of credential abuse or unexpected logins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.