CVE-2026-20168
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access. This vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-06 17:16:20.590000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-20168",
"sourceIdentifier": "[email protected]",
"published": "2026-05-06T17:16:20.590",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access.\r\n\r\nThis vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de gestión basada en web de Cisco IoT Field Network Director podría permitir a un atacante remoto autenticado con privilegios bajos recuperar archivos a los que no tiene permiso para acceder.\n\nEsta vulnerabilidad se debe a comprobaciones insuficientes de acceso a archivos. Un atacante podría explotar esta vulnerabilidad al enviar una entrada manipulada en la interfaz de gestión basada en web. Un exploit exitoso podría permitir al atacante leer archivos a los que no está autorizado a acceder."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IoT Field Network Director (IoT-FND)",
"defaultStatus": "unknown",
"versions": [
{
"version": "4.5.1",
"status": "affected"
},
{
"version": "4.4.3",
"status": "affected"
},
{
"version": "4.1.0",
"status": "affected"
},
{
"version": "4.1.3",
"status": "affected"
},
{
"version": "4.6.1",
"status": "affected"
},
{
"version": "4.1.1",
"status": "affected"
},
{
"version": "4.4.0",
"status": "affected"
},
{
"version": "4.2.0",
"status": "affected"
},
{
"version": "4.4.2",
"status": "affected"
},
{
"version": "4.3.0",
"status": "affected"
},
{
"version": "4.6.0",
"status": "affected"
},
{
"version": "4.4.4",
"status": "affected"
},
{
"version": "4.3.2",
"status": "affected"
},
{
"version": "4.1.2",
"status": "affected"
},
{
"version": "4.4.1",
"status": "affected"
},
{
"version": "4.5.0",
"status": "affected"
},
{
"version": "4.3.1",
"status": "affected"
},
{
"version": "4.7.0",
"status": "affected"
},
{
"version": "4.6.2",
"status": "affected"
},
{
"version": "4.7.1",
"status": "affected"
},
{
"version": "4.7.2",
"status": "affected"
},
{
"version": "4.8.0",
"status": "affected"
},
{
"version": "4.8.1",
"status": "affected"
},
{
"version": "4.9.0",
"status": "affected"
},
{
"version": "4.9.1",
"status": "affected"
},
{
"version": "4.10.0",
"status": "affected"
},
{
"version": "4.9.2",
"status": "affected"
},
{
"version": "4.11.0",
"status": "affected"
},
{
"version": "4.12.0",
"status": "affected"
},
{
"version": "4.12.1",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-06T17:59:03.972223Z",
"id": "CVE-2026-20168",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-388"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.0-117",
"matchCriteriaId": "AFAEB500-F901-497A-8E7A-13F350338E83"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}