The vulnerability allows an attacker who has both the encryption password and access to backup files to decrypt the configuration backup. Once decrypted, the attacker can extract authentication credentials stored in the backup file, use them to access internal-only APIs, and ultimately execute arbitrary commands as the root user of the device.

Cisco Nexus Dashboard is affected by this flaw. No specific version information is supplied, so all installations of the product should be considered potentially vulnerable.

The vulnerability has a CVSS score of 6.5, indicating a medium to high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. An attacker must obtain the encryption password and a valid backup file, then use those credentials to decrypt the backup and perform the malicious actions. Exploitation likely requires either local access to backups or the ability to obtain the backup files through other means. The attack vector appears to be indirect, relying on compromised backup file access rather than a direct remote service attack.