Cisco Nexus Dashboard Path Traversal Vulnerability
TL;DR 📌
- A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This vulnerability is due to insufficient validation of the contents of a backup file. An attacker with valid Administrator credentials could exploit this vulnerability by restoring a crafted…
- Highest CVSS: 6.5 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20344.
What it is
CVE-2025-20344 is a path traversal vulnerability in the backup restore functionality of Cisco Nexus Dashboard. The flaw stems from insufficient validation of the contents of a backup file when it is restored to the device.
Exploitation requires an authenticated attacker with valid Administrator credentials. They would need to craft a malicious backup file and restore it through the normal backup restore process. This is a data-plane operation carried out via a legitimate administrative function, not an unauthenticated network-facing bug.
A successful exploit gives the attacker root privileges on the underlying shell of the affected device — a jump from Administrator-level application access to full root control of the host.
The issue affects Cisco Nexus Dashboard regardless of device configuration. Cisco has confirmed that Nexus Dashboard Fabric Controller (NDFC), Nexus Dashboard Insights, and Nexus Dashboard Orchestrator (NDO) are not affected.
What to do
- Upgrade Nexus Dashboard to the fixed release: 4.1(1g) for the 4.1 train.
- If running 3.2 or earlier, Cisco advises migrating to a fixed release rather than expecting a patch on that train.
- There are no workarounds — the only mitigation is upgrading.
- In the interim, tightly control who holds Administrator credentials on Nexus Dashboard, since exploitation depends entirely on that access level. Review and restrict who is permitted to perform backup restore operations.
- Treat backup files as sensitive artefacts: verify their provenance before any restore, and avoid restoring files sourced from outside trusted, controlled backups.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 4.1 | 4.1(1g) |
For leadership 🧭
Executive summary. Cisco Nexus Dashboard’s backup restore feature can be abused by anyone holding Administrator credentials to gain root access to the device itself, turning an application-level account into full host control. There’s no workaround, so this needs to go into the next patch cycle rather than being deferred indefinitely.
Why it matters:
- The path traversal sits in the backup restore process, meaning exploitation requires an existing Administrator account rather than network-level access.
- A successful restore of a crafted backup file elevates an Administrator to root on the underlying shell, well beyond what that role is meant to grant.
- Nexus Dashboard is affected regardless of configuration, though Cisco has confirmed NDFC, Nexus Dashboard Insights, and NDO are not impacted.
- With no workaround available, the only route to closing the gap is upgrading to the fixed release.
Now / Next / Later:
- Now: Identify every Nexus Dashboard instance in your estate, confirm its software train, and review who currently holds Administrator credentials capable of performing backup restores.
- Next: Upgrade affected Nexus Dashboard deployments to 4.1(1g); systems still on 3.2 or earlier should be migrated to a fixed release rather than left in place.
- Later: Establish a control process for backup file provenance and restrict backup restore operations to a minimal set of trusted administrators, since this function will remain a privileged escalation path even after patching.