CVE-2026-20042: Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20042?
CVE-2026-20042 is rated as a medium severity vulnerability due to its potential to expose sensitive configuration information.
How do I fix CVE-2026-20042?
To fix CVE-2026-20042, ensure that access to configuration backup files is restricted and that the encryption password is securely managed.
What type of access does CVE-2026-20042 allow?
CVE-2026-20042 allows unauthorized access to sensitive configuration data if an attacker possesses the encryption password.
Which software is affected by CVE-2026-20042?
The affected software for CVE-2026-20042 is Cisco Nexus Dashboard.
Can CVE-2026-20042 lead to data exposure?
Yes, CVE-2026-20042 can lead to exposure of sensitive information through unauthorized configuration backup access.