Vulnerability record · CVE-2019-1620 · published 27 June 2019
CVE-2019-1620: Cisco DCNM web interface unauthenticated arbitrary file upload to root RCE
Cisco · Data Center Network Manager
Cisco Data Center Network Manager (DCNM) has incorrect permission settings in its web-based management interface that allow an unauthenticated, remote attacker to upload arbitrary files. Because uploaded files can be written to the filesystem and executed with root privileges, this is a full compromise of the DCNM appliance.
Description
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could exploit this vulnerability by uploading specially crafted data to the affected device. A successful exploit could allow the attacker to write arbitrary files on the filesystem and execute code with root privileges on the affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution as root with a CVSS of 9.8 and very high EPSS makes this an urgent patch-first issue.
What it is
Cisco Data Center Network Manager (DCNM) has incorrect permission settings in its web-based management interface that allow an unauthenticated, remote attacker to upload arbitrary files. Because uploaded files can be written to the filesystem and executed with root privileges, this is a full compromise of the DCNM appliance.
Impact
An attacker gains the ability to write arbitrary files and execute code as root on the affected device, taking complete control of the DCNM system.
Attack surface
Reachable over the network through the DCNM web-based management interface; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.8378, 99.675th percentile) and multiple third-party advisories and public exploit write-ups are referenced, indicating mature public exploitation.
What to do
- Apply the Cisco security advisory patch for DCNM (cisco-sa-20190626-dcnm-codex) immediately.
- If patching cannot be done at once, restrict network access to the DCNM web management interface to trusted management networks only.
- Place DCNM behind a firewall or reverse proxy that blocks untrusted upload requests and enforces authentication.
- Audit DCNM filesystem for unexpected or recently written files, especially in web-accessible directories.
- Monitor Cisco advisories for updated fixed versions and verify the installed DCNM build is not vulnerable.
Detection
- Monitor DCNM web server logs for POST requests to upload endpoints from unexpected source IPs.
- Alert on creation of new files in DCNM web directories or other writable paths outside normal update windows.
- Watch for unexpected processes running as root spawned by the DCNM web service.
- Use file integrity monitoring on DCNM filesystem paths to detect unauthorized file writes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-1620 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1620), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
