PT-2025-34898 · Cisco · Cisco Nexus Dashboard Fabric Controller+1

Published 2025-08-27 · Updated 2025-08-28 · CVE-2025-20348

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) (affected versions not specified)

Description: A vulnerability exists in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC). This issue is due to missing authorization controls on certain REST API endpoints. An authenticated, low-privileged, remote attacker could exploit this by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to view sensitive information regarding HTTP Proxy and NTP configurations, upload images, and damage image files on an affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2025-12710

CVE-2025-20348

Affected Products

Cisco Nexus Dashboard

Cisco Nexus Dashboard Fabric Controller

References · 6

• https://bdu.fstec.ru/vul/2025-12710 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nshs-urapi-gJuBVFpu · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20348 · Security Note
• https://twitter.com/CVEnew/status/1960745854236835932 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960857613098197454 · Twitter Post