SSH EUVD-2025-16891

The CVSS 8.7 score reflects High severity with critical characteristics: AV:N (network-accessible, no physical access required), AC:H (attack complexity is high, suggesting some network positioning or timing challenges), PR:N (no authentication required), UI:N (no user interaction needed), S:C (scope changed—impacts resources beyond the vulnerable component), C:H (high confidentiality impact via credential capture), I:H (high integrity impact via device impersonation), A:N (no availability impact). The scope change (S:C) elevates the score despite no availability impact, indicating the vulnerability crosses trust boundaries. Without confirmed EPSS probability data, KEV active exploitation status, or public POC code, risk assessment relies on CVSS and attack vector analysis. However, the AC:H component suggests real-world exploitation requires favorable network conditions (e.g., ARP spoofing, DNS hijacking, or network position between NDFC and devices). For organizations using NDFC to manage production fabric infrastructure, this is a HIGH priority due to: (1) network-level accessibility, (2) credential capture potential affecting downstream systems, (3) device impersonation enabling lateral movement or configuration tampering. This is NOT a low-real-risk-high-CVSS issue; the threat is substantive if NDFC is internet-facing or accessible from untrusted network segments. Prioritize based on NDFC deployment architecture and network exposure.

An attacker positioned on the network between a Cisco NDFC controller and its managed fabric devices (e.g., via ARP spoofing on the same subnet, DNS hijacking, or BGP hijacking for remote scenarios) intercepts SSH traffic. When NDFC initiates an SSH session to a managed switch to retrieve device status or push configuration, the attacker's machine intercepts the connection. Due to insufficient host key validation in NDFC, the controller accepts the attacker's public key instead of verifying the device's legitimate key. The attacker becomes a transparent proxy, decrypting the SSH session (they now hold the symmetric key), capturing any plaintext or insufficiently protected credentials transmitted over the SSH channel. The attacker can also inject commands, alter device responses, or modify configurations sent to the device. This could escalate to credential harvesting if NDFC transmits device management credentials over SSH, lateral movement to other fabric devices, or persistent access via device configuration tampering. While AC:H suggests the attacker must achieve favorable network positioning, this is feasible in multi-tenant cloud environments, compromised network equipment, or insider-threat scenarios. No confirmed public POC is noted, but the vulnerability is straightforward to exploit with standard MITM tools (e.g., Ettercap, mitmproxy) once network position is achieved.