CVE-2019-1620

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could exploit this vulnerability by uploading specially crafted data to the affected device. A successful exploit could allow the attacker to write arbitrary files on the filesystem and execute code with root privileges on the affected device.

• CWE-264
• CWE-22

• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jul/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108906Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Jul/11Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-codexVendor Advisory
• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/154304/Cisco-Data-Center-Network-Manager-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jul/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108906Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Jul/11Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-codexVendor Advisory

Published

Jun 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16193In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be…5.4
• CVE-2019-16194SQL injection vulnerabilities in Centreon through 19.04 allo…9.8
• CVE-2019-16195Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before…6.1
• CVE-2019-16197In htdocs/societe/card.php in Dolibarr 10.0.1, the value of …6.1
• CVE-2019-16198KSLabs KSWEB 3.93 allows ../ directory traversal, as demonst…6.5
• CVE-2019-16199eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 a…9.8
• CVE-2019-16200GNU Serveez through 0.2.2 has an Information Leak. An attack…7.5
• CVE-2019-16201WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x t…7.5
• CVE-2019-16202MISP before 2.4.115 allows privilege escalation in certain s…6.5
• CVE-2019-16203Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could …7.5
• CVE-2019-16204Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j …7.5
• CVE-2019-16205A vulnerability, in Brocade SANnav versions before v2.0, cou…8.8