Platform
cisco
Component
cisco-nexus-dashboard
Opgelost in
1.1.1
1.1.1
1.1.1
1.1.1
1.1.1
2.0.1
1.1.1
1.1.1
1.1.1
2.1.1
2.1.1
2.0.1
2.0.1
2.1.1
2.0.1
2.2.1
2.2.1
2.2.1
2.1.1
2.3.1
2.3.1
2.3.1
2.3.1
2.3.1
3.0.1
3.0.1
3.1.1
3.1.1
3.2.1
3.2.1
3.3.1
3.3.1
3.3.1
4.0.1
3.3.1
3.2.1
3.2.1
3.2.1
3.1.1
4.1.1
CVE-2026-20042 is a vulnerability affecting Cisco Nexus Dashboard versions up to 4.1(1g). This flaw allows an attacker possessing the encryption password and access to Full or Config-only backup files to decrypt them and potentially access sensitive information. Successful exploitation could grant access to internal-only APIs on the affected device, potentially leading to unauthorized access and control. A patch is available from Cisco.
The primary impact of CVE-2026-20042 lies in the potential exposure of sensitive authentication details embedded within encrypted configuration backup files. An attacker who successfully decrypts these files could obtain credentials used to access internal APIs within the Cisco Nexus Dashboard. This access could be leveraged to perform actions such as modifying configurations, accessing sensitive data, or potentially gaining broader control over the affected device. The blast radius extends to any data or functionality accessible through these internal APIs, depending on the specific configuration and permissions granted. This vulnerability highlights the importance of secure backup practices and robust access controls.
CVE-2026-20042 was publicly disclosed on April 1, 2026. The vulnerability's impact is contingent on an attacker already possessing the encryption password, which may limit immediate widespread exploitation. The vulnerability is not currently listed on CISA KEV. Public proof-of-concept exploits are not currently available, but the potential for decryption and API access warrants careful attention.
Organizations utilizing Cisco Nexus Dashboard for network management, particularly those with legacy configurations or shared hosting environments, are at risk. Environments where backup files are not adequately protected or where encryption passwords are easily accessible are especially vulnerable.
• cisco / network-device:
# Check for backup files with suspicious names or modification dates
find /opt/cisco/nxos/bin/ -name '*.backup' -mtime -7• cisco / network-device:
# Check Nexus Dashboard version
show version• generic web:
# Check for exposed configuration backup endpoints
curl -I https://<nexus_dashboard_ip>/backupdisclosure
Exploit Status
EPSS
0.03% (8% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2026-20042 is to upgrade Cisco Nexus Dashboard to a version that addresses the vulnerability. Cisco has released a patch, and users should apply it as soon as possible. As a temporary workaround, restrict access to configuration backup files and ensure that the encryption password is not easily compromised. Consider implementing multi-factor authentication for administrative access to further reduce the risk of unauthorized access. Regularly review and audit backup configurations to ensure they adhere to security best practices.
Werk Cisco Nexus Dashboard bij naar een versie die niet is aangetast door deze kwetsbaarheid. Raadpleeg het Cisco advisory voor meer details en de gecorrigeerde versies.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2026-20042 is a medium severity vulnerability in Cisco Nexus Dashboard versions ≤4.1(1g) that allows attackers with encryption passwords to access sensitive authentication details from configuration backup files.
If you are using Cisco Nexus Dashboard version 4.1(1g) or earlier, you are potentially affected by this vulnerability. Check your version and upgrade as soon as possible.
Upgrade to a patched version of Cisco Nexus Dashboard. Refer to the official Cisco advisory for specific version details and upgrade instructions.
There are currently no confirmed reports of active exploitation, but the potential for decryption and API access warrants caution.
Refer to the official Cisco Security Advisory for CVE-2026-20042 on the Cisco website (search for CVE-2026-20042 on Cisco.com).
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.