// For flags

CVE-2022-20860

Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

Severity Score

7.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus Dashboard Fabric Controller, formerly Data Center Network Manager (DCNM) controllers. An attacker could exploit this vulnerability by using man-in-the-middle techniques to intercept the traffic between the affected device and the controllers, and then using a crafted certificate to impersonate the controllers. A successful exploit could allow the attacker to alter communications between devices or view sensitive information, including Administrator credentials for these controllers.

Una vulnerabilidad en la implementación de SSL/TLS de Cisco Nexus Dashboard podría permitir a un atacante remoto no autenticado alterar las comunicaciones con los controladores asociados o visualizar información confidencial. Esta vulnerabilidad se presenta porque los certificados de servidor SSL no son comprobados cuando Cisco Nexus Dashboard establece una conexión con Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC o Cisco Nexus Dashboard Fabric Controller, anteriormente controladores Data Center Network Manager (DCNM). Un atacante podría explotar esta vulnerabilidad al usar técnicas de tipo man-in-the-middle para interceptar el tráfico entre el dispositivo afectado y los controladores, y luego usar un certificado diseñado para hacerse pasar por los controladores. Una explotación con éxito podría permitir al atacante alterar las comunicaciones entre los dispositivos o visualizar información confidencial, incluyendo las credenciales de administrador de estos controladores

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2021-11-02 CVE Reserved
  • 2022-07-21 CVE Published
  • 2024-10-12 EPSS Updated
  • 2024-11-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Nexus Dashboard
Search vendor "Cisco" for product "Nexus Dashboard"
 >= 1.1 < 2.2\(1h\)
Search vendor "Cisco" for product "Nexus Dashboard" and version " >= 1.1 < 2.2\(1h\)"
-
Affected