4.3
CVE-2026-20189
- EPSS 0.21%
- Veröffentlicht 06.05.2026 16:15:24
- Zuletzt bearbeitet 29.06.2026 16:53:33
- Quelle psirt@cisco.com
- CVE-Watchlists
- Unerledigt
Cisco Prime Infrastructure Information Disclosure Vulnerability
A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary log files from the server. This vulnerability is due to insufficient authorization checks on the download service API. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to download sensitive log files that they would otherwise not have authorization to access. To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Prime Infrastructure Version < 3.10.6
Cisco ≫ Prime Infrastructure Version3.10.6 Update-
Cisco ≫ Prime Infrastructure Version3.10.6 Updatesecurity_update_01
Cisco ≫ Prime Infrastructure Version3.10.6 Updatesecurity_update_02
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.116 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@cisco.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-unauth-infodiscl-LFnLgmey