CVE-2025-20344 — Cisco Nexus Dashboard Path Traversal Vulnerability

Back Back to CVE browser

HIGH

Cisco Nexus Dashboard Path Traversal Vulnerability

Published Aug 27, 2025

7.2

HIGH

CVSS 3.1

EPSS 0.59%

Description

A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This vulnerability is due to insufficient validation of the contents of a backup file. An attacker with valid Administrator credentials could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to gain root privileges on the underlying shell on the affected device.

Affected products

Vendor Cisco Product Cisco Nexus Dashboard Default
n/a
- Version
  1.1(0c)
  Status
  affected
  Constraints
  -
- Version
  1.1(0d)
  Status
  affected
  Constraints
  -
- Version
  1.1(2h)
  Status
  affected
  Constraints
  -
- Version
  1.1(2i)
  Status
  affected
  Constraints
  -
- Version
  1.1(3c)
  Status
  affected
  Constraints
  -
- Version
  1.1(3d)
  Status
  affected
  Constraints
  -
- Version
  1.1(3e)
  Status
  affected
  Constraints
  -
- Version
  1.1(3f)
  Status
  affected
  Constraints
  -
- Version
  2.0(1b)
  Status
  affected
  Constraints
  -
- Version
  2.0(1d)
  Status
  affected
  Constraints
  -
- Version
  2.0(2g)
  Status
  affected
  Constraints
  -
- Version
  2.0(2h)
  Status
  affected
  Constraints
  -
- Version
  2.1(1d)
  Status
  affected
  Constraints
  -
- Version
  2.1(1e)
  Status
  affected
  Constraints
  -
- Version
  2.1(2d)
  Status
  affected
  Constraints
  -
- Version
  2.1(2f)
  Status
  affected
  Constraints
  -
- Version
  2.2(1e)
  Status
  affected
  Constraints
  -
- Version
  2.2(1h)
  Status
  affected
  Constraints
  -
- Version
  2.2(2d)
  Status
  affected
  Constraints
  -
- Version
  2.3(1c)
  Status
  affected
  Constraints
  -
- Version
  2.3(2b)
  Status
  affected
  Constraints
  -
- Version
  2.3(2c)
  Status
  affected
  Constraints
  -
- Version
  2.3(2d)
  Status
  affected
  Constraints
  -
- Version
  2.3(2e)
  Status
  affected
  Constraints
  -
- Version
  3.0(1f)
  Status
  affected
  Constraints
  -
- Version
  3.0(1i)
  Status
  affected
  Constraints
  -
- Version
  3.1(1k)
  Status
  affected
  Constraints
  -
- Version
  3.1(1l)
  Status
  affected
  Constraints
  -
- Version
  3.1(1n)
  Status
  affected
  Constraints
  -
- Version
  3.2(1e)
  Status
  affected
  Constraints
  -
- Version
  3.2(1i)
  Status
  affected
  Constraints
  -
- Version
  3.2(2f)
  Status
  affected
  Constraints
  -
- Version
  3.2(2g)
  Status
  affected
  Constraints
  -
- Version
  3.2(2m)
  Status
  affected
  Constraints
  -
- Version
  3.3(1a)
  Status
  affected
  Constraints
  -
- Version
  3.3(1b)
  Status
  affected
  Constraints
  -
- Version
  3.3(2b)
  Status
  affected
  Constraints
  -
- Version
  3.3(2g)
  Status
  affected
  Constraints
  -
- Version
  4.0(1i)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Nexus Dashboard

n/a

Version	Status	Constraints
1.1(0c)	affected	-
1.1(0d)	affected	-
1.1(2h)	affected	-
1.1(2i)	affected	-
1.1(3c)	affected	-
1.1(3d)	affected	-
1.1(3e)	affected	-
1.1(3f)	affected	-
2.0(1b)	affected	-
2.0(1d)	affected	-
2.0(2g)	affected	-
2.0(2h)	affected	-
2.1(1d)	affected	-
2.1(1e)	affected	-
2.1(2d)	affected	-
2.1(2f)	affected	-
2.2(1e)	affected	-
2.2(1h)	affected	-
2.2(2d)	affected	-
2.3(1c)	affected	-
2.3(2b)	affected	-
2.3(2c)	affected	-
2.3(2d)	affected	-
2.3(2e)	affected	-
3.0(1f)	affected	-
3.0(1i)	affected	-
3.1(1k)	affected	-
3.1(1l)	affected	-
3.1(1n)	affected	-
3.2(1e)	affected	-
3.2(1i)	affected	-
3.2(2f)	affected	-
3.2(2g)	affected	-
3.2(2m)	affected	-
3.3(1a)	affected	-
3.3(1b)	affected	-
3.3(2b)	affected	-
3.3(2g)	affected	-
4.0(1i)	affected	-

Remediation

No remediation recorded yet.

Metrics

0.59% 0.00590

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00590

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.59% (0.00590)	46.22th	v5 (v2026.06.15)
Jun 15, 2026	0.55% (0.00550)	41.45th	v5 (v2026.06.15)
Aug 28, 2025	0.04% (0.00039)	10.24th	v4 (v2025.03.14)

Weaknesses (1)

CWE-22

Path Traversal

References (1)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-ptrs-XU2Fm2Wb
Vendor Advisory

Link	Providers	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-ptrs-XU2Fm2Wb		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cisco

Published Aug 27, 2025

Updated Feb 26, 2026

Reserved Oct 10, 2024

Link CVE-2025-20344

CISA Vulnrichment

Updated Aug 27, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-20344

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-20344