Rohan Rao

**Name of the Vulnerable Software and Affected Versions** Cisco Nexus Dashboard Fabric Controller (NDFC) versions (affected versions not specified) **Description** The issue is related to a lack of authorization in the implementation of the Cisco NDFC platform's application programming interface. This could allow a remote attacker with low privileges to impact the integrity of protected information. The vulnerability exists due to missing authorization controls on some REST API endpoints, which could be exploited by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions, such as reading device configuration information, uploading files, and modifying uploaded files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Nexus Dashboard Fabric Controller (NDFC) versions not specified **Description** A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Nexus Dashboard Fabric Controller (NDFC) (affected versions not specified) **Description** The issue is related to the improper storage of sensitive information within backup files, allowing an attacker with access to these files to view protected data. This could include NDFC-connected device credentials, the NDFC site manager private key, and the scheduled backup file encryption key. An attacker could exploit this by parsing the contents of a backup file generated from an affected device, potentially accessing sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.