How severe is CVE-2020-3522?

CVE-2020-3522 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2020-3522 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-3522?

CVE-2020-3522 affects Cisco Data Center Network Manager. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-3522?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-3522 published?

CVE-2020-3522 was published on 2020-08-26 and last updated on 2026-06-17.

CVE-2020-3522

CVE-2020-3522 is a medium-severity vulnerability in Cisco Data Center Network Manager with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
CVSS v2: 6.5
EPSS exploit prediction: 1% (52nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-863
Affected product: Cisco Data Center Network Manager
Published: 2020-08-26
Last modified: 2026-06-17

Description

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the affected software allows users to access resources that are intended for administrators only. An attacker could exploit this vulnerability by submitting a crafted URL to an affected device. A successful exploit could allow the attacker to add, delete, and edit certain network configurations in the same manner as a user with administrative privileges.

Frequently asked questions

What is CVE-2020-3522?: A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the affected software allows users to access resources that are intended for administrators only. An attacker could exploit this vulnerability by submitting a crafted URL to an affected device. A successful exploit could allow the attacker to add, delete, and edit certain network configurations in the same manner as a user with administrative privileges.
How severe is CVE-2020-3522?: CVE-2020-3522 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2020-3522 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-3522?: CVE-2020-3522 affects Cisco Data Center Network Manager. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-3522?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-3522 published?: CVE-2020-3522 was published on 2020-08-26 and last updated on 2026-06-17.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-auth-bypass-MYeFpFcF

Affected products (1)

cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Data Center Network Manager

CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
CVE-2020-3382 — Critical (CVSS 9.8): A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote…
CVE-2019-15976 — Critical (CVSS 9.8): Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an…
CVE-2019-15975 — Critical (CVSS 9.8): Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an…
CVE-2019-1620 — Critical (CVSS 9.8): A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an…
CVE-2019-1619 — Critical (CVSS 9.8): A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an…

All CVEs affecting Cisco Data Center Network Manager →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →