CVE-2026-20167
Received Received - Intake
Denial of Service in Cisco IoT Field Network Director

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router. This vulnerability is due to improper error handling. An attacker could exploit this vulnerability by submitting crafted input to the web-based management interface. A successful exploit could allow the attacker to request unauthorized files from a remote router, causing the router to reload and resulting in a DoS condition.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-14
NVD
CVE-2026-20167
EUVD
EUVD-2026-27850
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
cisco iot_field_network_director *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should apply the software updates released by Cisco for the IoT Field Network Director. There are no available workarounds for this issue.

Executive Summary

This vulnerability exists in the web-based management interface of Cisco IoT Field Network Director. It allows an authenticated remote attacker with low privileges to cause a denial-of-service (DoS) condition on a remotely managed router.

The issue is caused by improper error handling. An attacker can exploit it by submitting specially crafted input to the management interface, which can lead to unauthorized file requests from the router. This causes the router to reload, resulting in a DoS condition.

Impact Analysis

The primary impact of this vulnerability is a denial-of-service (DoS) condition on a remotely managed router. This means that an attacker could cause the router to reload unexpectedly, disrupting network availability and potentially causing downtime for services relying on that router.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart