CVE-2020-3597— Cisco Nexus Data Broker Software Path Traversal Vulnerability
Quick assessment
Affected
Cisco Cisco Nexus Data Broker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Nexus Data Broker是美国思科（Cisco）公司的一个网络路由监控方案。该软件基于事件驱动，可以提供实时网络流可视化。 Cisco Nexus Data Broker software 存在安全漏洞，攻击者可利用该漏洞可以通过覆盖任意文件受影响的软件在一个受影响的设备。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059.004 · Unix Shell T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-3597
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Nexus Data Broker Software Path Traversal Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient validation of configuration backup files. An attacker could exploit this vulnerability by persuading an administrator to restore a crafted configuration backup file. A successful exploit could allow the attacker to overwrite arbitrary files that are accessible through the affected software on an affected device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
相对路径遍历
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Nexus Data Broker 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Nexus Data Broker是美国思科（Cisco）公司的一个网络路由监控方案。该软件基于事件驱动，可以提供实时网络流可视化。 Cisco Nexus Data Broker software 存在安全漏洞，攻击者可利用该漏洞可以通过覆盖任意文件受影响的软件在一个受影响的设备。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Nexus Data Broker | n/a | - |
|
II. Public POCs for CVE-2020-3597
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3597
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-3597 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-path-traversal-wVDyXZPy vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2020-10-08 · 14 CVEs total
| CVE-2020-3544 | 8.8 HIGH | Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execu |
| CVE-2020-3535 | 7.8 HIGH | Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability |
| CVE-2020-3598 | 6.5 MEDIUM | Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability |
| CVE-2020-3567 | 6.5 MEDIUM | Cisco Industrial Network Director Denial of Service Vulnerability |
| CVE-2020-3543 | 6.5 MEDIUM | Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulne |
| CVE-2020-3602 | 6.3 MEDIUM | Cisco StarOS Privilege Escalation Vulnerability |
| CVE-2020-3596 | 5.9 MEDIUM | Cisco Expressway Series and TelePresence Video Communication Server Denial of Service Vuln |
| CVE-2020-3568 | 5.8 MEDIUM | Cisco Email Security Appliance URL Filtering Bypass Vulnerability |
| CVE-2020-3589 | 4.8 MEDIUM | Cisco Identity Services Engine Cross-Site Scripting Vulnerability |
| CVE-2020-3601 | 4.4 MEDIUM | Cisco StarOS Privilege Escalation Vulnerability |
| CVE-2020-3536 | Cisco SD-WAN vManage Cross-Site Scripting Vulnerability | |
| CVE-2020-3467 | Cisco Identity Services Engine Authorization Bypass Vulnerability | |
| CVE-2020-3320 | Cisco Firepower Management Center Cross-Site Scripting Vulnerability |
IV. Related Vulnerabilities
Same vendor: Cisco
-
CVE-2026-76497
Cisco Expressway Series Software Hardening Release: October -
CVE-2026-76524
Open Source Snort 3 Control Channel Socket Aribitrary Comman -
CVE-2026-76505
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unica -
CVE-2026-76496
Cisco Expressway Series Software Hardening Release: October -
CVE-2026-76495
Cisco Expressway Series Software Hardening Release: October
Same weakness: CWE-23
-
CVE-2026-115812
Relative path traversal during model archive extraction in A -
CVE-2026-114714
Roundcube 1.6.20/1.7.5 插件路径遍历漏洞 -
CVE-2026-114110
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RE -
CVE-2026-111093
JetBrains Datalore <2026.2.1 未授权路径穿越漏洞 -
CVE-2026-103508
Path traversal via logging configuration in P4Search
V. Comments for CVE-2020-3597
No comments yet