Riskcovery

CVE-2026-20168

Cisco IoT Field Network Director Path Traversal Vulnerability

State
Published
Severity
6.5 Medium
Published
May 6, 2026
Updated
May 6, 2026
Reserved
Oct 8, 2025

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access.

This vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Ncisco

Weaknesses

Affected Products

ProductVersions
Cisco IoT Field Network Director (IoT-FND)Cisco
  • 4.5.1Affected
  • 4.4.3Affected
  • 4.1.0Affected
  • 4.1.3Affected
  • 4.6.1Affected
  • 4.1.1Affected
  • 4.4.0Affected
  • 4.2.0Affected
  • 4.4.2Affected
  • 4.3.0Affected
  • 4.6.0Affected
  • 4.4.4Affected
  • 4.3.2Affected
  • 4.1.2Affected
  • 4.4.1Affected
  • 4.5.0Affected
  • 4.3.1Affected
  • 4.7.0Affected
  • 4.6.2Affected
  • 4.7.1Affected
  • 4.7.2Affected
  • 4.8.0Affected
  • 4.8.1Affected
  • 4.9.0Affected
  • 4.9.1Affected
  • and 5 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.