CVE-2026-20168 MEDIUM

CVE-2026-20168: Cisco IoT Field Network Director Path Traversal Vulnerability

Vendor Cisco
Product Cisco IoT Field Network Director (IoT-FND)
Weakness CWE-388
Published May 6, 2026
Last update May 6, 2026

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access. This vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access.

Key dates

02Disclosure timeline

May 6, 2026 CVE published
May 6, 2026 Record updated