Description
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Nexus Dashboard | 1.1(3e); 1.1(3c); 1.1(3d); 1.1(0d); 1.1(2i); 2.0(1b); 1.1(2h); 1.1(0c); 1.1(3f); 2.1(1d); 2.1(1e); 2.0(2g); 2.0(2h); 2.1(2d); 2.0(1d); 2.2(1h); 2.2(1e); 2.2(2d); 2.1(2f); 2.3(1c) |
References
Timeline
- Published
- Apr 1, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Analyzed