Description
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.
Metrics
CVSS 3.1 8.7/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Data Center Network Manager | 11.2(1); 7.0(2); 10.3(2)IPFM; 10.1(1); 7.2(3); 7.2(2); 7.2(1); 11.0(1); 10.4(1); 10.2(1); 7.2(2a); 10.1(2); 7.1(1); 12.1(1); 11.1(1); 10.3(1); 10.3(1)R(1); 7.0(1); 10.0(1); 7.1(2) |
| Cisco | Cisco Nexus Dashboard | 3.1(1k); 3.1(1l); 3.2(1e); 3.2(1i); 3.3(1a); 3.3(1b); 3.3(2b); 4.0(1i); 3.3(2g) |
References
Timeline
- Published
- Jun 4, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed