A vulnerability in the logging feature of Cisco NX-OS Software for various Cisco Nexus and UCS devices could allow an authenticated, local attacker to access sensitive information. This issue arises from improper logging of sensitive data, enabling attackers to exploit the vulnerability by accessing log files. A successful exploit could lead to the exposure of sensitive information, including stored credentials.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2025-20290 |
Exploitation
To exploit this vulnerability, an attacker with local access must navigate to the file system where the log files are stored. By accessing these log files, the attacker can retrieve sensitive information that may include stored credentials, thereby compromising the security of the affected systems.
Affected Products
- Cisco Nexus 3000 Series Switches: Switches designed for data center environments.
- Cisco Nexus 9000 Series Switches: High-performance switches for cloud-scale networking.
- Cisco UCS 6400 Fabric Interconnects: Fabric interconnects for unified computing systems.
- Cisco UCS 6500 Series Fabric Interconnects: Advanced fabric interconnects for UCS environments.
- Cisco UCS 9108 100G Fabric Interconnects: High-speed fabric interconnects for UCS systems.
Mitigation
To mitigate this vulnerability, it is recommended that users restrict access to log files and implement strict access controls. Additionally, users should regularly review and audit log files to ensure that sensitive information is not being improperly logged or accessed.