Cisco Nexus Dashboard Fabric Controller (REST API / web UI): A low-privileged NDFC user

Impact

A low-privileged NDFC user — the sort of read-mostly account you hand to an NOC or a tenant liaison — gets command injection on the fabric controller. NDFC holds the credentials for and pushes config to every switch it manages, so this is a straight path from a minor account to control of the whole leaf/spine build.

Who can reach it

Authenticated but low-privileged, remote. Any valid NDFC login is enough.

What to do

Upgrade NDFC. Controller-side software upgrade, data plane unaffected. Afterwards rotate the device credentials NDFC stores, because those are what an attacker would have taken.

References