SB2025082827 - Multiple vulnerabilities in Cisco Nexus Dashboard and Nexus Dashboard Fabric Controller

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2025-20347)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authorization controls on some REST API endpoints. A remote user can send specially crafted API requests to gain access to sensitive information or upload and modify files on the target device.

2) Protection Mechanism Failure (CVE-ID: CVE-2025-20348)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authorization controls on some REST API endpoints. A remote user can send specially crafted API requests to gain access to sensitive information or upload and modify files on the target device.

3) Path traversal (CVE-ID: CVE-2025-20344)

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to insufficient validation of the contents of a backup file. A remote administrator can restore a crafted backup file and gain root privileges on the target device.

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nshs-urapi-gJuBVFpu
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-ptrs-XU2Fm2Wb