CVE-2026-20115

MEDIUM EPSS 4.8%

Published Mar 25, 20263mo ago · Modified Jun 17, 20262w ago

6.1 CVSS 3.1

Medium

Published Mar 25, 2026 3mo ago

Last Modified Jun 17, 2026 2w ago

Description

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.

CVSS Details

Base Score

6.1

Exploitability

1.6

Impact

4.0

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction Required

Scope Changed

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

4.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-319

References 1

sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.