Cisco Nexus Dashboard Fabric Controller SSH Host Key Validation Vulnerability

🚨SEVERITY: HIGH — CVSS 8.7Security Advisory

TL;DR 📌

  • A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow…
  • Highest CVSS: 8.7 (High).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2025-20163.

What it is

CVE-2025-20163 sits in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC), specifically in how it validates SSH host keys for connections to NDFC-managed devices. Validation is insufficient, so NDFC will accept a host key it should reject.

The access path is network-based and requires no authentication. An attacker positioned to intercept SSH traffic between NDFC and the devices it manages can perform a machine-in-the-middle attack, presenting a fraudulent host key that NDFC does not properly check. This lets the attacker impersonate a managed device.

What the attacker gets is interception of the SSH session content, including the credentials NDFC uses to authenticate to that device. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects high attack complexity — the attacker needs a network position to intercept the traffic — but no privileges or user interaction, and a scope change with high confidentiality and integrity impact.

This affects NDFC regardless of device configuration; Cisco notes that NDFC releases 11.5 and earlier were formerly branded Cisco Data Center Network Manager (DCNM). Nexus Dashboard Insights and Nexus Dashboard Orchestrator (NDO) are confirmed not affected.

What to do

  • Upgrade to Cisco Nexus Dashboard 3.2(2f) or later, which bundles Cisco NDFC Release 12.2.3 containing the fix. All NDFC releases earlier than 12.2.3 are affected.
  • If running Nexus Dashboard 3.1, there is no in-branch fix — migrate to a fixed 3.2 release (3.2(2f) or later).
  • There are no workarounds; the only remediation is upgrading.
  • After upgrading, be aware the fix introduces a new SSH host key verification feature that is disabled by default for backward compatibility. Enable it explicitly if you want the protection active now — see the SSH Host Key Mismatch section of the NDFC Overview and Initial Setup guide for configuration steps.
  • Treat any SSH sessions between NDFC and managed devices prior to patching as potentially interceptable, and rotate device credentials after upgrading and enabling host key verification.

Fixed releases

Affected release First fixed release
3.2 3.2(2f)

For leadership 🧭

Executive summary. Cisco Nexus Dashboard Fabric Controller can be tricked into trusting a fake SSH host key, letting an attacker positioned on the network path intercept management traffic and capture the credentials NDFC uses to access switches. There is no workaround, so this needs an upgrade plan and, critically, a manual step afterwards, since the fix is off by default.

Why it matters:

  • An attacker with network position between NDFC and its managed Nexus switches can impersonate a device and capture the credentials NDFC uses to authenticate, giving a foothold into fabric management.
  • No authentication or user interaction is needed by the attacker, and the impact covers both confidentiality and integrity of the intercepted session (CVSS 8.7).
  • This affects NDFC on all supported device configurations, and there is no workaround — the only remediation is a version upgrade.
  • The fix itself ships disabled by default for backward compatibility, so upgrading alone does not close the gap; the new host key verification feature must be turned on explicitly.

Now / Next / Later:

  • Now: Identify every Nexus Dashboard deployment running NDFC earlier than 12.2.3 (Nexus Dashboard releases prior to 3.2(2f), including all 3.1 branches) and prioritise them for the next change window.
  • Next: Upgrade to Cisco Nexus Dashboard 3.2(2f) or later (3.1 deployments must migrate, as there is no in-branch fix), then explicitly enable the new SSH host key verification feature rather than relying on default settings.
  • Later: After enabling host key verification, rotate the credentials NDFC uses to authenticate to managed devices, since any pre-patch sessions could have been intercepted, and review NDFC upgrade paths so new security features are checked and enabled as part of the standard change process rather than left at their default state.

Source