A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This vulnerability is due to insufficient validation of the contents of a backup file. An attacker with valid Administrator credentials could exploit this vulnerability by restoring a crafted backup file to an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20344 |
Exploitation
To exploit this vulnerability, an attacker must have valid Administrator credentials and can restore a specially crafted backup file to the affected Cisco Nexus Dashboard device. This action could lead to gaining root privileges on the device’s underlying shell, allowing further malicious activities.
Affected Products
- Cisco Nexus Dashboard: A management platform for Cisco Nexus switches that may be vulnerable due to the backup restore functionality.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper validation of backup files before restoration and limit access to Administrator credentials. Regularly updating the software and applying security patches provided by Cisco can also help protect against potential exploits.