CVE-2019-1622: Cisco DCNM web interface improper access control exposes logs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote access to sensitive device data with a very high EPSS score and public references to unauthenticated RCE in the same product outweigh the medium CVSS base score.

What it is

Cisco Data Center Network Manager's web-based management interface enforces improper access controls on certain URLs, letting an unauthenticated remote attacker request them directly. Successful requests return log files and diagnostic information from the device. Because the data is reachable without credentials, it can feed follow-on attacks against the management plane.

Impact

An attacker gains read access to log files and diagnostic data from the affected DCNM device, which may contain internal hostnames, addresses, configuration details or credentials useful for lateral movement. No integrity or availability impact is described.

Attack surface

Reachable over the network through the DCNM web management interface by requesting specific URLs; the CVSS vector shows no privileges and no user interaction required. The interface must be exposed to the attacker, so internet-facing or broadly reachable DCNM instances carry the most risk.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.789, 99.6th percentile) and third-party references describe unauthenticated remote code execution in DCNM, indicating active interest in this product. The record does not confirm exploitation of this specific information-disclosure flaw.

What to do

• Apply the Cisco DCNM software update from the vendor advisory cisco-sa-20190626-dcnm-infodiscl; patch is the primary fix.
• Restrict network access to the DCNM web management interface to trusted administrative networks and block it from the internet.
• Require authentication and strong access control at a reverse proxy or load balancer in front of DCNM where feasible.
• Review DCNM logs and diagnostic files for sensitive content and rotate any credentials or secrets they may expose.
• Monitor Cisco advisories for related DCNM flaws, since public references describe unauthenticated RCE in the same product.

Detection

• Alert on unauthenticated HTTP requests to DCNM management URLs that return log or diagnostic file content, especially non-standard paths.
• Baseline normal DCNM web access and flag requests for log, diagnostic or backup-style endpoints from unexpected source IPs.
• Inspect DCNM and web server logs for sequential or automated URL probing of the management interface.
• Correlate DCNM access logs with outbound connections or follow-on exploitation attempts against the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.