Medium severity · published Aug 27, 2025
CVE-2025-20290
Cisco NXOS Software Sensitive Log Information Disclosure Vulnerability
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nexus 9000 Series Switches in standalone NX-OS mode, Cisco UCS 6400 Fabric Interconnects, Cisco UCS 6500 Series Fabric Interconnects, and Cisco UCS 9108 100G Fabric Interconnects could allow an authenticated, local attacker access to sensitive information.
This vulnerability is due to improper logging of sensitive information. An attacker could exploit this vulnerability by accessing log files on the file system where they are stored. A successful exploit could allow the attacker to access sensitive information, such as stored credentials.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Cisco NX-OS Software · Cisco
9.2(3); 7.0(3)I5(2); 7.0(3)I4(5); 7.0(3)I4(6); 9.2(2v); 7.0(3)I4(7); +34 more · source: vendor
CU
Cisco Unified Computing System (Managed) · Cisco
4.0(4c); 4.0(2b); 4.1(2a); 4.0(1a); 4.0(2a); 4.0(1b); +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-20290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-20290
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-infodis-TEcTYSFG
More from Cisco NX-OS Software
6.7
CVE-2024-20399
Cisco NX-OS Software CLI Command Injection Vulnerability
9.8
CVE-2026-76501
Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76486
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76485
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76459
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
