CVE-2026-20115

Summary

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco IOS XE Software17.14.1affected
CiscoCisco IOS XE Software17.14.1aaffected
CiscoCisco IOS XE Software17.15.1affected
CiscoCisco IOS XE Software17.15.1waffected
CiscoCisco IOS XE Software17.15.1aaffected
CiscoCisco IOS XE Software17.15.2affected
CiscoCisco IOS XE Software17.15.1baffected
CiscoCisco IOS XE Software17.15.1xaffected
CiscoCisco IOS XE Software17.15.1zaffected
CiscoCisco IOS XE Software17.15.3affected
CiscoCisco IOS XE Software17.15.2caffected
CiscoCisco IOS XE Software17.15.2aaffected
CiscoCisco IOS XE Software17.15.1yaffected
CiscoCisco IOS XE Software17.15.2baffected
CiscoCisco IOS XE Software17.15.3aaffected
CiscoCisco IOS XE Software17.15.4affected
CiscoCisco IOS XE Software17.15.3baffected
CiscoCisco IOS XE Software17.15.4daffected
CiscoCisco IOS XE Software17.15.4eaffected
CiscoCisco IOS XE Software17.16.1affected
CiscoCisco IOS XE Software17.16.1aaffected
CiscoCisco IOS XE Software17.17.1affected
CiscoCisco IOS XE Software17.18.1affected
CiscoCisco IOS XE Software17.18.1waffected
CiscoCisco IOS XE Software17.18.1aaffected

Weaknesses

  • CWE-319: Cleartext Transmission of Sensitive Information

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References