CVE-2026-20115 — Cisco / Cisco IOS XE Software

Description (CNA)

A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.

Affected (CNA)

Vendor / product	Versions
Cisco / Cisco IOS XE Software	affected 17.14.1; affected 17.14.1a; affected 17.15.1; affected 17.15.1w; affected 17.15.1a; affected 17.15.2; affected 17.15.1b; affected 17.15.1x; affected 17.15.1z; affected 17.15.3; affected 17.15.2c; affected 17.15.2a; affected 17.15.1y; affected 17.15.2b; affected 17.15.3a; affected 17.15.4; affected 17.15.3b; affected 17.15.4d; affected 17.15.4e; affected 17.16.1; affected 17.16.1a; affected 17.17.1; affected 17.18.1; affected 17.18.1w; affected 17.18.1a

Vendor / product

Versions

Cisco / Cisco IOS XE Software

affected 17.14.1; affected 17.14.1a; affected 17.15.1; affected 17.15.1w; affected 17.15.1a; affected 17.15.2; affected 17.15.1b; affected 17.15.1x; affected 17.15.1z; affected 17.15.3; affected 17.15.2c; affected 17.15.2a; affected 17.15.1y; affected 17.15.2b; affected 17.15.3a; affected 17.15.4; affected 17.15.3b; affected 17.15.4d; affected 17.15.4e; affected 17.16.1; affected 17.16.1a; affected 17.17.1; affected 17.18.1; affected 17.18.1w; affected 17.18.1a

CWE

CWE-319

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.