CVE-2025-20163 - CVE House
Back to Database
Status published High CVE-2025-20163

Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability

Vulnerability Description

A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-20163

Credits & Attribution

No credits recorded in the NVD database.

References

More from Cisco

View All →
CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Critical 10
CVE-2025-20377
Cisco Unified Intelligence Center API Information Disclosure Vulnerability
Medium 4.3
CVE-2025-20376
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
Medium 6.5
CVE-2025-20375
Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability
Medium 6.5
CVE-2025-20374
Cisco Unified Contact Center Express Arbitrary File Download Vulnerability
Medium 4.9

Affected Vendor

Affected Software

Cisco Data Center Network Manager, Cisco Nexus Dashboard
Vulnerable Versions:
11.2(1), 7.0(2), 10.3(2)IPFM, 10.1(1), 7.2(3), 7.2(2), 7.2(1), 11.0(1), 10.4(1), 10.2(1), 7.2(2a), 10.1(2), 7.1(1), 12.1(1), 11.1(1), 10.3(1), 10.3(1)R(1), 7.0(1), 10.0(1), 7.1(2), 11.4(1), 10.4(2), 11.3(1), 11.5(1), 11.5(2), 11.5(3), 12.0.1a, 11.5(3a), 12.0.2d, 12.0.2f, 11.5(4), 12.1.1, 12.1.1e, 12.1.1p, 12.1.2e, 12.1.2p, 12.1.3b, 12.2.1, 12.2.2, 3.1(1k), 3.1(1l), 3.2(1e), 3.2(1i), 3.3(1a), 3.3(1b), 3.3(2b), 4.0(1i), 3.3(2g)

Timeline

Official Publish: June 4th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-322

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.