Cisco Nexus Dashboard Fabric Controller vulnerabilities

13 CVEs affecting Cisco Nexus Dashboard Fabric Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-20536, published 2024-11-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-20432, published 2024-10-02. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack…
CVE-2024-20449, published 2024-10-02. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This…
CVE-2024-20348, published 2024-04-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This…
CVE-2024-20536, published 2024-11-06. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to…
CVE-2024-20444, published 2024-10-02. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to…
CVE-2024-20441, published 2024-10-02. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability…
CVE-2024-20477, published 2024-10-02. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability…
CVE-2024-20442, published 2024-10-02. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected…
CVE-2024-20438, published 2024-10-02. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists…
CVE-2024-20491, published 2024-10-02. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because…

Latest

CVE-2024-20490, published 2024-10-02. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view…
CVE-2024-20448, published 2024-10-02. High severity, CVSS 8.6. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view…