A configuration‑upload process in Cisco IOS XE Software for Cisco Meraki uses an insecure tunnel between the device and the Cisco Meraki Dashboard, allowing anyone who can intercept that traffic to read confidential device configuration data. This represents a lack of encryption or authentication in transit, matching CWE‑319, and exposes sensitive operational information that could be leveraged for further attacks.

Cisco IOS XE Software on Cisco Meraki devices are affected; the advisory does not list specific firmware or release versions, so administrators must verify that their installations run builds that are pending a patch or update from Cisco and follow the vendor’s guidance to identify vulnerable builds.

The CVSS base score of 6.1 indicates moderate severity. The description states that an attacker on the network path between the device and the dashboard can exploit the flaw; this inference is drawn from the mention of an "on‑path attack" and is not directly listed elsewhere. No EPSS score is available, and the vulnerability is not in the CISA KEV catalog. Because no public patch or workaround is referenced, the risk remains until a vendor update is applied or the device is isolated from the dashboard network segment.