CVE-2022-20913: Cisco Nexus Dashboard Arbitrary File Write Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-22 · updated 2026-06-17
Weakness: CWE-23

Description

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with Administrator credentials could exploit this vulnerability by uploading a crafted file. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.

Affected products

Cisco Nexus Dashboard: from 2.0 before 2.2\(1e\) — fixed in 2.2\(1e\)

How to fix

Upgrade to a fixed version: Cisco Nexus Dashboard 2.2\(1e\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20913 or the next vulnerability affects your stack