EXECUTIVE SUMMARY:
CVE-2026-20189 with a CVSS score of 4.3 is a vulnerability in the log file download functionality of Cisco Prime Infrastructure, affecting versions 3.9 and earlier and 3.10. This vulnerability allows an authenticated, remote attacker to download arbitrary log files from the server due to insufficient authorization checks on the download service API. An attacker can exploit this vulnerability by submitting a crafted URL request to an affected device, which requires valid credentials to access the web-based management interface. Successful exploitation allows the attacker to download sensitive log files they would otherwise not have authorization to access. The attacker gains the capability to access sensitive log files, which can lead to business impact and consequences such as loss of sensitive information, potential data breaches, and compromised system security. Exploitation of this vulnerability is dependent on the attacker having valid credentials to access the affected device.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-20189 with a CVSS score of 4.3 is a vulnerability in the log file download functionality of Cisco Prime Infrastructure, affecting versions 3.9 and earlier and 3.10. This vulnerability allows an authenticated, remote attacker to download arbitrary log files from the server due to insufficient authorization checks on the download service API. An attacker can exploit this vulnerability by submitting a crafted URL request to an affected device, which requires valid credentials to access the web-based management interface. Successful exploitation allows the attacker to download sensitive log files they would otherwise not have authorization to access. The attacker gains the capability to access sensitive log files, which can lead to business impact and consequences such as loss of sensitive information, potential data breaches, and compromised system security. Exploitation of this vulnerability is dependent on the attacker having valid credentials to access the affected device.[emaillocker id="1283"]
RECOMMENDATION:
We recommend you to update Cisco Prime Infrastructure to version 3.10.6 Security Update 3.
REFERENCES:
The following reports contain further technical details:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-unauth-infodiscl-LFnLgmey?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Prime%20Infrastructure%20Information%20Disclosure%20Vulnerability%26vs_k=1
[/emaillocker]