PT-2025-34897 · Cisco · Cisco Nexus Dashboard Fabric Controller+1

Published 2025-08-27 · Updated 2025-08-28 · CVE-2025-20347

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) (affected versions not specified)

Description: A vulnerability exists in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) due to missing authorization controls. An authenticated, low-privileged, remote attacker could exploit this issue by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2025-12708

CVE-2025-20347

Affected Products

Cisco Nexus Dashboard

Cisco Nexus Dashboard Fabric Controller

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nshs-urapi-gJuBVFpu · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12708 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20347 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20347 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/1960756542711509191 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960860173217440210 · Twitter Post
• https://twitter.com/CVEnew/status/1960745855339913253 · Twitter Post