Industrial Network Director
CVE-2023-20038
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the application used to encrypt application data and remote credentials. An attacker could exploit this vulnerability by gaining local access to the server Cisco Industrial Network Director is installed on. A successful exploit could allow the attacker to decrypt data allowing the attacker to access remote systems monitored by Cisco Industrial Network Director.
AnalysisAI
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-321. A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the application used to encrypt application data and remote credentials. An attacker could exploit this vulnerability by gaining local access to the server Cisco Industrial Network Director is installed on. A successful exploit could allow the attacker to decrypt data allowing the attacker to access remote systems monitored by Cisco Industrial Network Director. Affected products include: Cisco Industrial Network Director.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Industrial Network Director
View allA vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could a
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthen
A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote
A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remo
A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacke
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthen
A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could all
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cro
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cro
A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attack
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today