CVE-2026-20189
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
06/05/2026
Last modified:
06/05/2026
Description
A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an&nbsp;authenticated, remote attacker to download arbitrary log files from the server.<br />
<br />
This vulnerability is due to insufficient authorization checks on the download service API. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to download sensitive log files that they would otherwise not have authorization to access.<br />
To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device.
Impact
Base Score 3.x
4.30
Severity 3.x
MEDIUM