CVE-2026-20115
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration
Severity
Medium 6.1
CVSS 3.1
Exploited
Not listed
EPSS
0.002
4.9th percentile
Discovered by
Vendor
Published by the vendor
Published
Mar 25, 2026
Assigned by cisco
Description
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.
Weakness: CWE-319
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco IOS XE Software | Routing & Switching | cna-assigner |
Vendor-reported affected versions (1)
- Cisco · Cisco IOS XE Software