Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-20347

Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit th vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Data Center Network Manager

Default version status: unknown

  • 11.2(1)affected
  • 7.0(2)affected
  • 10.3(2)IPFMaffected
  • 10.1(1)affected
  • 7.2(3)affected
  • 7.2(2)affected
  • 7.2(1)affected
  • 11.0(1)affected
  • 10.4(1)affected
  • 10.2(1)affected
  • 7.2(2a)affected
  • 10.1(2)affected
  • 7.1(1)affected
  • 12.1(1)affected
  • 11.1(1)affected
  • 10.3(1)affected
  • 10.3(1)R(1)affected
  • 7.0(1)affected
  • 10.0(1)affected
  • 7.1(2)affected
  • 11.4(1)affected
  • 10.4(2)affected
  • 11.3(1)affected
  • 11.5(1)affected
  • 11.5(2)affected
  • 11.5(3)affected
  • 12.0.1aaffected
  • 11.5(3a)affected
  • 12.0.2daffected
  • 12.0.2faffected
  • 11.5(4)affected
  • 12.1.1affected
  • 12.1.1eaffected
  • 12.1.1paffected
  • 12.1.2eaffected
  • 12.1.2paffected
  • 12.1.3baffected
  • 12.2.1affected
  • 12.2.2affected
  • 12.2.3affected

References