Riskcovery

CVE-2024-20448

Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability

State
Published
Severity
6.3 Medium
Published
Oct 2, 2024
Updated
Oct 2, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information.

This vulnerability is due to the improper storage of sensitive information within config only and full backup files. An attacker could exploit this vulnerability by parsing the contents of a backup file that is generated from an affected device. A successful exploit could allow the attacker to access sensitive information, including NDFC-connected device credentials, the NDFC site manager private key, and the scheduled backup file encryption key.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:Ncisco

Weaknesses

  • CWE-313 Cleartext Storage in a File or on Disk

Affected Products

ProductVersions
Cisco Data Center Network ManagerCisco
  • 11.2(1)Affected
  • 7.0(2)Affected
  • 10.3(2)IPFMAffected
  • 10.1(1)Affected
  • 7.2(3)Affected
  • 7.2(2)Affected
  • 7.2(1)Affected
  • 11.0(1)Affected
  • 10.4(1)Affected
  • 10.2(1)Affected
  • 7.2(2a)Affected
  • 10.1(2)Affected
  • 7.1(1)Affected
  • 12.1(1)Affected
  • 11.1(1)Affected
  • 10.3(1)Affected
  • 10.3(1)R(1)Affected
  • 7.0(1)Affected
  • 10.0(1)Affected
  • 7.1(2)Affected
  • 11.4(1)Affected
  • 10.4(2)Affected
  • 11.3(1)Affected
  • 11.5(1)Affected
  • 11.5(2)Affected
  • and 13 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.