CVE-2025-20163: Cisco Nexus Dashboard

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.

Affected products

• Cisco Nexus Dashboard: before 3.2\(2f\) (fixed in 3.2\(2f\))

Published 2025-06-04. Last modified 2026-06-17.