Vulnerability Details : CVE-2020-26072
A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit this vulnerability by sending SOAP API requests to affected devices for devices that are outside their authorized domain. A successful exploit could allow the attacker to access and modify information on devices that belong to a different domain.
Vulnerability category: BypassGain privilege
Products affected by CVE-2020-26072
- cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-26072
0.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-26072
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST | |
|
8.7
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
2.3
|
5.8
|
Cisco Systems, Inc. | |
|
8.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
2.3
|
5.8
|
NIST |
CWE ids for CVE-2020-26072
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: ykramarz@cisco.com (Secondary)
References for CVE-2020-26072
Jump to