CVE-2025-20347

mediumPriorität · verfolgen · 0EPSS 0.003 · 17. PerzentilDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (17th) EPSS

CVSS 5.4 · medium

Is it mine?

66 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit th vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco Data Center Network Managercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15.4mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · psirt@cisco.com USAusnutzbarkeit 2.8 · Auswirkung 2.5

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · NCSC-NL NL

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-693USCWE-693USCWE-693US

betroffene Produkte (66)

Betroffene Produkte und Versionsbereiche.

Cisco Nexus Dashboard <4.1(1g)alle Versionencert_bundDE
Cisco Nexus Dashboard Fabric Controller (NDFC)alle Versionencert_bundDEcpe:/a:cisco:nexus_dashboard:fabric_controller_%28ndfc%29
Cisco Nexus Dashboard< 4.1(1g)cert_bundDE
Cisco Cisco Data Center Network Manageralle Versionencisco_csafUS
Cisco Cisco Data Center Network Manager≤ 10.3(2)IPFMenisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 11.5(2)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 11.5(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 10.4(2)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 7.0(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 11.2(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 12.2.3enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 12.1.1eenisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 7.1(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 10.2(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 11.0(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 10.1(2)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 7.2(2)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 12.1(1)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 7.2(3)enisa_euvdEU
Cisco Cisco Data Center Network Manager≤ 7.1(2)enisa_euvdEU

20 von 66 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2025-0287Kwetsbaarheden verholpen in Cisco NX-OS SoftwareNL2025-09-11csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Cisco NX-OS Software voor Nexus 3000 en 9000 Series Switches.
WID-SEC-W-2025-1915Cisco Nexus, Dashboard, NX-OS: Mehrere SchwachstellenDeutsch2025-08-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Cisco Nexus, Cisco NX-OS, Cisco Unified Computing System (UCS) und Cisco Nexus Dashboard ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Root-Rechte zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
cisco-sa-nshs-urapi-gJuBVFpuCisco Nexus Dashboard and Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerabilities2025-08-27csaf · cisco_csafUS
Multiple vulnerabilities in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. These vulnerabilities exist because of missing authorization controls on some REST API endpoints. An attacker could exploit these vulnerabilities by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device. Note: These vulnerabilities affect only a subset of REST API endpoints and do not affect the web-based management interface. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf ncsc_nl NVD CVE.org MITRE

veröffentlicht 2025-08-27geändert 2026-06-17

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan