CVE-2026-20174
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-22
Limitación incorrecta de nombre de ruta a un directorio restringido (Path Traversal)
Fecha de publicación:
01/04/2026
Última modificación:
01/04/2026
Descripción
*** Pendiente de traducción *** A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system.<br />
<br />
This vulnerability is due to insufficient validation of the metadata update file. An attacker could exploit this vulnerability by crafting a metadata update file and manually uploading it to an affected device. A successful exploit could allow the attacker to write arbitrary files to the underlying operating system as the&nbsp;root user. To exploit this vulnerability, the attacker must have valid administrative credentials.<br />
Note: Manual uploading of metadata files is typical for Air-Gap environments but not for Cisco Intersight Cloud connected devices. However, the manual upload option exists for both deployments.
Impacto
Puntuación base 3.x
4.90
Gravedad 3.x
MEDIA