A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.
Conclusion & alert: CVE-2025-20163 is rated Moderate Risk (45.1/100): CVSS High severity, with low exploitation likelihood (EPSS 0.11%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-31 | 0.03% | 0.11% | +0.08% |
| 2 | 2025-11-21 | 0.05% | 0.03% | -0.02% |
| 3 | 2025-11-18 | — | 0.05% | — |
Full EPSS history (4 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.7 | 3.1 | HIGH |
|
2.2 | 5.8 | [email protected] |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| cisco | nexus_dashboard | < 3.2\(2f\) | cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:* |