What’s Vulnerable › Vulnerabilities
CVE-2024-20448: Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-10-02 · updated 2026-06-17
- Weakness: CWE-313
Description
A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within config only and full backup files. An attacker could exploit this vulnerability by parsing the contents of a backup file that is generated from an affected device. A successful exploit could allow the attacker to access sensitive information, including NDFC-connected device credentials, the NDFC site manager private key, and the scheduled backup file encryption key.
Affected products
- Cisco Nexus Dashboard Fabric Controller: before 12.2.2 — fixed in 12.2.2
How to fix
Upgrade to a fixed version: Cisco Nexus Dashboard Fabric Controller 12.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-20448 or the next vulnerability affects your stack