CVE-2026-20115 — Cleartext Transmission of Sensitive Info in Cisco IOS XE Software

CWE-319 — Cleartext Transmission of Sensitive Info4 documents4 sources

Severity

6.1MEDIUMNVD

EPSS

0.0%

top 97.03%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software

Timeline

PublishedMar 25

Description

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NExploitability: 1.6 | Impact: 4.0

Affected Packages1 packages

▶CVEListV5cisco/cisco_ios_xe_software25 versions+24

🔴Vulnerability Details

CVEList

CVE-2026-20115: A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information↗2026-03-25

▶

GHSA

GHSA-xm4h-9vf3-j26j: A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information↗2026-03-25

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability↗2026-03-25

▶