A flaw in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights permits a server‑side request forgery (SSRF) when an authenticated user is tricked into clicking a specially crafted link. The improper validation of selected HTTP requests lets an attacker force the device to issue arbitrary network requests to an attacker‑controlled server. Successful exploitation enables execution of arbitrary script code within the device’s management interface or leakage of sensitive browser‑based data, compromising confidentiality and integrity of the system.

The vulnerability affects Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights. No specific affected versions are listed in the CNA data, so any running installation of these products should be considered vulnerable until a vendor update is applied.

With a CVSS score of 6.1 the severity is moderate, and the EPSS score is not available while the vulnerability is not listed in the KEV catalog. The attack vector is remote and requires social engineering to prompt an authenticated user to click a malicious link. Once achieved, the attacker can send arbitrary outbound requests from the device, potentially accessing internal networks and exfiltrating data.