CVE-2025-20163— Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-20163
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
未进行实体认证的密钥交换
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Nexus Dashboard Fabric Controller 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Nexus Dashboard Fabric Controller是美国思科（Cisco）公司的一种用于管理 Cisco NX-OS 部署的综合网络管理平台，适用于数据中心的 LAN、SAN 和 IP Fabric for Media (IPFM) 网络 。 Cisco Nexus Dashboard Fabric Controller存在安全漏洞，该漏洞源于SSH主机密钥验证不足，可能导致中间人攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Data Center Network Manager | 11.2(1) | - | |
| Cisco | Cisco Nexus Dashboard | 3.1(1k) | - |
II. Public POCs for CVE-2025-20163
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-20163
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2025-06-04 · 12 CVEs total
| CVE-2025-20286 | 9.9 CRITICAL | ISE on AWS Static Credential |
| CVE-2025-20261 | 8.8 HIGH | Cisco Integrated Management Controller Privilege Escalation Vulnerability |
| CVE-2025-20273 | 6.1 MEDIUM | Cisco Unified Intelligent Contact Management Enterprise Cross-Site Scripting vulnerability |
| CVE-2025-20278 | 6.0 MEDIUM | Cisco Unified Communications Products Command Injection Vulnerability |
| CVE-2025-20259 | 5.3 MEDIUM | Cisco ThousandEyes Endpoint Agent for Windows Arbitrary File Write Vulnerability |
| CVE-2025-20275 | 5.3 MEDIUM | Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability |
| CVE-2025-20130 | 4.9 MEDIUM | Cisco Identity Services Engine Access Control Bypass Vulnerability |
| CVE-2025-20279 | 4.8 MEDIUM | Cisco Unifed Contact Center Express Stored Cross-Site Scripting Vulnerability |
| CVE-2025-20129 | 4.3 MEDIUM | Cisco Customer Collaboration Platform Information Disclosure Vulnerability |
| CVE-2025-20276 | 3.8 LOW | Cisco Unified Contact Center Express Remote Code Execution Vulnerability |
| CVE-2025-20277 | 3.4 LOW | Cisco Unified Contact Center Express Path Traversal Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Data Center Network Manager
- CVE-2025-20347
Cisco Nexus Dashboard Fabric Controller Unauthorized REST AP - CVE-2020-3538
Cisco Data Center Network Manager Path Traversal Vulnerabil - CVE-2020-3539
Cisco Data Center Network Manager Authorization Bypass Vulne - CVE-2024-20536
Cisco Nexus Dashboard Fabric Controller SQL Injection Vulner - CVE-2024-20490
Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-322
- CVE-2026-1354
Zero Motorcycles Firmware Key Exchange without Entity Authen - CVE-2025-13914
Apstra: SSH host key validation vulnerability for managed de - CVE-2026-33697
CoCoS attested TLS is vulnerable to relay attacks via extrac - CVE-2026-1709
Keylime: keylime: authentication bypass allows unauthorized - CVE-2025-62501
SSH Hostkey Misconfiguration Vulnerability in TP-Link Archer
V. Comments for CVE-2025-20163
No comments yet