Cisco Nexus Dashboard and Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerabilities
TL;DR 📌
- Multiple vulnerabilities in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. These vulnerabilities exist because of missing authorization controls on some REST API endpoints. An attacker could exploit…
- Highest CVSS: 5.4 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20347, CVE-2025-20348.
What it is
CVE-2025-20347 and CVE-2025-20348 affect the REST API in Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC). Both stem from missing authorization checks on a subset of REST API endpoints, rather than a flaw in the web-based management interface, which Cisco states is unaffected.
An attacker needs an authenticated, low-privileged account and network access to the REST API. From there, crafted API requests to the affected endpoints let them perform limited Administrator-level functions: reading sensitive configuration data (HTTP proxy and NTP settings), and uploading or modifying image files on the device.
CVE-2025-20347 (NDFC) scores 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. CVE-2025-20348 (Nexus Dashboard) scores 5.0 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N — the changed scope reflecting that the impact crosses a security boundary. Neither issue affects availability. Cisco confirms Nexus Dashboard Insights and Nexus Dashboard Orchestrator (NDO) are not vulnerable.
Cisco found these during internal security testing and states it is not aware of any public exploitation.
What to do
- Upgrade to Cisco Nexus Dashboard 4.1(1g), the first fixed release listed. If running Nexus Dashboard 3.2 or earlier, migrate to a fixed release — there is no in-place patch for those trains.
- NDFC customers: since Nexus Dashboard 3.1(1k), NDFC ships as part of unified Nexus Dashboard releases, so remediate by migrating to the appropriate fixed Nexus Dashboard release rather than patching NDFC separately.
- There are no workarounds — do not rely on network segmentation or ACLs as a substitute for upgrading.
- Review existing low-privileged API accounts and credentials, since exploitation requires only authenticated, low-privilege access rather than administrative rights.
- Confirm memory and hardware compatibility with the target release before upgrading, and check the advisory’s linked bug IDs for the most current affected/fixed release details.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 4.1 | 4.1(1g) |
For leadership 🧭
Executive summary. Any account with basic API access to Nexus Dashboard or NDFC can currently reach a subset of REST endpoints and perform limited admin actions, including reading configuration data and altering image files. There’s no workaround, so remediation depends entirely on scheduling the upgrade during the next change window.
Why it matters:
- Low-privileged, authenticated users can reach REST API endpoints that were meant to require Administrator rights, exposing HTTP proxy and NTP configuration data.
- The same missing authorization allows uploading and modifying image files on affected Nexus Dashboard or NDFC devices, which manage switch fabric infrastructure.
- No workaround exists, so ACLs or network segmentation cannot substitute for patching — the only fix is upgrading the software itself.
- NDFC is now distributed inside unified Nexus Dashboard releases, so remediation means migrating the whole platform, not applying an isolated NDFC patch.
Now / Next / Later:
- Now: Identify every Nexus Dashboard and NDFC instance in the estate and confirm which release train each is running, including standalone NDFC before the unified release model.
- Next: Upgrade to Nexus Dashboard 4.1(1g) in the next change window, migrating any 3.2-or-earlier deployments and NDFC instances to a fixed unified release, since no workaround is available.
- Later: Review and tighten low-privileged API account provisioning for Nexus Dashboard and NDFC, since this flaw shows such accounts can already reach functions meant to be admin-only.