CVE-2015-0666

What it actually does

Directory traversal in the fmserver servlet permits unauthenticated remote reading of arbitrary files on the server filesystem by supplying crafted pathnames.

Why it matters to the business

Attackers can exfiltrate configuration files, credentials, and other sensitive data from exposed Cisco Prime DCNM instances, increasing risk of further compromise; the vulnerability remains actively exploited in the wild with a past CISA remediation deadline, raising urgency for any remaining unpatched deployments.

How an attack unfolds

An attacker sends an HTTP request to the fmserver servlet containing a crafted pathname that traverses directories; the server responds with the contents of the targeted file, allowing the attacker to harvest sensitive information without authentication.

How to fix it

Upgrade Cisco Prime Data Center Network Manager to version 7.1(1) or later; restrict network access to the management interface; implement web application firewall rules to block traversal sequences targeting the fmserver servlet.

How to confirm the fix worked

Confirm the installed DCNM version is 7.1(1) or newer; test that requests containing traversal sequences to fmserver return errors or sanitized responses instead of file contents; review access control lists on the management interface.

Typical attack path

1. Identify an internet-facing or internally reachable Cisco Prime DCNM instance
2. Craft an HTTP GET or POST request to the fmserver servlet with directory traversal sequences in the pathname parameter
3. Receive and parse the server response containing the requested file contents
4. Use obtained data (credentials, topology information) to pivot to additional systems

How to detect it

Inspect web server or application logs for requests to the fmserver servlet containing sequences such as ../ or %2e%2e%2f; look for unusually large or unexpected file responses from the servlet; correlate with outbound data transfers from the DCNM host.

• fmserver.*\.\./
• GET /.*fmserver.*%2e%2e
• fmserver servlet traversal

What your security team should do

• Immediately inventory all Cisco Prime DCNM deployments and apply the 7.1(1) or newer upgrade where missing
• Block or tightly restrict external access to the DCNM management interface
• Deploy WAF or IPS signatures that detect directory traversal patterns against the fmserver endpoint
• Monitor KEV listings and threat intelligence feeds for continued exploitation of this path traversal class