CVE-2026-20168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20168", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.391Z", "datePublished": "2026-05-06T16:15:48.379Z", "dateUpdated": "2026-05-06T17:59:11.531Z"}, "containers": {"cna": {"title": "Cisco IoT Field Network Director Path Traversal Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access.\r\n\r\nThis vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u", "name": "cisco-sa-iot-fnd-dos-n8N26Q4u"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-iot-fnd-dos-n8N26Q4u", "discovery": "EXTERNAL", "defects": ["CSCwm81008"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Error Handling", "type": "cwe", "cweId": "CWE-388"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IoT Field Network Director (IoT-FND)", "versions": [{"version": "4.5.1", "status": "affected"}, {"version": "4.4.3", "status": "affected"}, {"version": "4.1.0", "status": "affected"}, {"version": "4.1.3", "status": "affected"}, {"version": "4.6.1", "status": "affected"}, {"version": "4.1.1", "status": "affected"}, {"version": "4.4.0", "status": "affected"}, {"version": "4.2.0", "status": "affected"}, {"version": "4.4.2", "status": "affected"}, {"version": "4.3.0", "status": "affected"}, {"version": "4.6.0", "status": "affected"}, {"version": "4.4.4", "status": "affected"}, {"version": "4.3.2", "status": "affected"}, {"version": "4.1.2", "status": "affected"}, {"version": "4.4.1", "status": "affected"}, {"version": "4.5.0", "status": "affected"}, {"version": "4.3.1", "status": "affected"}, {"version": "4.7.0", "status": "affected"}, {"version": "4.6.2", "status": "affected"}, {"version": "4.7.1", "status": "affected"}, {"version": "4.7.2", "status": "affected"}, {"version": "4.8.0", "status": "affected"}, {"version": "4.8.1", "status": "affected"}, {"version": "4.9.0", "status": "affected"}, {"version": "4.9.1", "status": "affected"}, {"version": "4.10.0", "status": "affected"}, {"version": "4.9.2", "status": "affected"}, {"version": "4.11.0", "status": "affected"}, {"version": "4.12.0", "status": "affected"}, {"version": "4.12.1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-05-06T16:15:48.379Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T17:59:03.972223Z", "id": "CVE-2026-20168", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T17:59:11.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T17:59:03.972223Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T17:59:08.080Z"}}], "cna": {"title": "Cisco IoT Field Network Director Path Traversal Vulnerability", "source": {"defects": ["CSCwm81008"], "advisory": "cisco-sa-iot-fnd-dos-n8N26Q4u", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IoT Field Network Director (IoT-FND)", "versions": [{"status": "affected", "version": "4.5.1"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.1.0"}, {"status": "affected", "version": "4.1.3"}, {"status": "affected", "version": "4.6.1"}, {"status": "affected", "version": "4.1.1"}, {"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.6.0"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.1.2"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.5.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.7.0"}, {"status": "affected", "version": "4.6.2"}, {"status": "affected", "version": "4.7.1"}, {"status": "affected", "version": "4.7.2"}, {"status": "affected", "version": "4.8.0"}, {"status": "affected", "version": "4.8.1"}, {"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.10.0"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.11.0"}, {"status": "affected", "version": "4.12.0"}, {"status": "affected", "version": "4.12.1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u", "name": "cisco-sa-iot-fnd-dos-n8N26Q4u"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access.\r\n\r\nThis vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-388", "description": "Error Handling"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-05-06T16:15:48.379Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20168", "state": "PUBLISHED", "dateUpdated": "2026-05-06T17:59:11.531Z", "dateReserved": "2025-10-08T11:59:15.391Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-05-06T16:15:48.379Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco IoT Field Network Director (IoT-FND)", "vendor": "Cisco", "versions": [{"status": "affected", "version": "4.5.1"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.1.0"}, {"status": "affected", "version": "4.1.3"}, {"status": "affected", "version": "4.6.1"}, {"status": "affected", "version": "4.1.1"}, {"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.6.0"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.1.2"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.5.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.7.0"}, {"status": "affected", "version": "4.6.2"}, {"status": "affected", "version": "4.7.1"}, {"status": "affected", "version": "4.7.2"}, {"status": "affected", "version": "4.8.0"}, {"status": "affected", "version": "4.8.1"}, {"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.10.0"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.11.0"}, {"status": "affected", "version": "4.12.0"}, {"status": "affected", "version": "4.12.1"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFAEB500-F901-497A-8E7A-13F350338E83", "versionEndExcluding": "5.0.0-117", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access.\r\n\r\nThis vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de gesti\u00f3n basada en web de Cisco IoT Field Network Director podr\u00eda permitir a un atacante remoto autenticado con privilegios bajos recuperar archivos a los que no tiene permiso para acceder.\n\nEsta vulnerabilidad se debe a comprobaciones insuficientes de acceso a archivos. Un atacante podr\u00eda explotar esta vulnerabilidad al enviar una entrada manipulada en la interfaz de gesti\u00f3n basada en web. Un exploit exitoso podr\u00eda permitir al atacante leer archivos a los que no est\u00e1 autorizado a acceder."}], "id": "CVE-2026-20168", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T17:59:03.972223Z", "version": "2.0.3"}}]}, "published": "2026-05-06T17:16:20.590", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-388"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.10.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.11.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.12.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.12.1"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Cisco IoT Field Network Director (IoT-FND)", "source": "cna", "vendor": "Cisco"}, "product": "iot_field_network_director", "vendor": "cisco"}], "created": "2026-05-06T18:30:09.252248+00:00", "updated": "2026-05-07T18:15:34.725013+00:00", "vendors": ["cisco", "cisco$PRODUCT$iot_field_network_director"]}