CVE-2020-3382

CVE-2020-3382 is a critical vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) that allows an unauthenticated, remote attacker to bypass authentication. This flaw stems from the use of a static encryption key shared across installations, enabling an attacker to craft a valid session token. The vulnerability carries a CVSS score of 9.8 (Critical), indicating a network-based attack with low complexity, requiring no user interaction, and resulting in complete compromise of confidentiality, integrity, and availability. A successful exploit grants administrative privileges, allowing arbitrary actions via the REST API. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion and media coverage, suggesting high awareness and potential for future exploitation.