CVE-2026-20042
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Summary
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information.
This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Nexus Dashboard | 1.1(3e) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3c) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3d) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(0d) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(2i) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(1b) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(2h) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(0c) | affected |
| Cisco | Cisco Nexus Dashboard | 1.1(3f) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(1d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(2h) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.0(1d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(1h) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 2.2(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.1(2f) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(1c) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2b) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2c) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2d) | affected |
| Cisco | Cisco Nexus Dashboard | 2.3(2e) | affected |
| Cisco | Cisco Nexus Dashboard | 3.0(1f) | affected |
| Cisco | Cisco Nexus Dashboard | 3.0(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1k) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1l) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(1e) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(1a) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(1b) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(2b) | affected |
| Cisco | Cisco Nexus Dashboard | 4.0(1i) | affected |
| Cisco | Cisco Nexus Dashboard | 3.3(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2f) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2g) | affected |
| Cisco | Cisco Nexus Dashboard | 3.2(2m) | affected |
| Cisco | Cisco Nexus Dashboard | 3.1(1n) | affected |
| Cisco | Cisco Nexus Dashboard | 4.1(1g) | affected |
Weaknesses
- CWE-295: Improper Certificate Validation
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.