CVE-2015-0666

CVE-2015-0666 is a directory traversal flaw (CWE-22) in the fmserver servlet of Cisco Prime Data Center Network Manager (DCNM), a management platform for Cisco data-center networking equipment. A remote attacker can send crafted requests containing traversal sequences to the fmserver servlet, bypassing intended path restrictions. Successful exploitation lets the attacker read arbitrary files from the DCNM server, potentially exposing configuration data, credentials, or other sensitive material stored on the host. Organizations running affected Cisco Prime DCNM deployments are affected, particularly where the management interface or fmserver servlet is reachable from untrusted networks. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (2022-03-25), indicating confirmed in-the-wild exploitation, with a high EPSS of 40.4% for exploitation in the next 30 days, though ransomware use has not been confirmed.

What to do: Apply Cisco updates for Prime DCNM per the vendor's instructions, as required by CISA's KEV listing. Inventory your environment for DCNM installations and check whether the fmserver servlet is exposed to untrusted networks, restricting access to trusted management hosts if patching must be deferred. Because the flaw has been exploited in the wild, review DCNM server access logs for signs of path-traversal requests while remediation is underway.