CVE-2025-20344
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Summary
A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device.
This vulnerability is due to insufficient validation of the contents of a backup file. An attacker with valid Administrator credentials could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to gain root privileges on the underlying shell on the affected device.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Nexus Dashboard | 1.1(3e) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3c) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3d) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(0d) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(2i) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(1b) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(2h) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(0c) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3f) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(1d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(2h) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(1d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(1h) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(2f) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(1c) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2b) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2c) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2e) | affected |
| Cisco | Cisco Nexus Dashboard | 3.0(1f) | affected |
| Cisco | Cisco Nexus Dashboard | 3.0(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1k) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1l) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(1a) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(1b) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(2b) | affected |
| Cisco | Cisco Nexus Dashboard | 4.0(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2f) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2m) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1n) | affected |
Weaknesses
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.