Summary

A logging function in Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator (NDO) writes sensitive data in cleartext into tech-support files. Anyone with access to such a file can read it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — 8.6 High.

Details

Tech support bundles are routinely shared with support staff and third parties, yet the logging code includes secrets verbatim.

Impact

Disclosure of HTTP proxy credentials (and related logged secrets) to anyone handling a tech-support file.

Remediation

  • Upgrade to a fixed Cisco NDFC/NDO release per the Cisco advisory.
  • Treat previously generated tech-support files as sensitive and rotate any exposed credentials.

References