CVE-2020-27130: Cisco Security Manager path traversal allows unauthenticated file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote file disclosure with a CVSS score of 9.1 and very high EPSS probability makes this a top remediation priority despite no KEV listing.

What it is

Cisco Security Manager fails to properly validate directory traversal sequences in requests to the affected device. An unauthenticated remote attacker can send a crafted request to download arbitrary files from the system. Because the exposed files may include credentials or configuration data, the flaw carries a critical severity rating.

Impact

An attacker gains read access to arbitrary files on the Cisco Security Manager host, which can expose sensitive configuration, credential or system data. The CVSS vector also rates integrity impact as high, though the description only confirms file download.

Attack surface

Reachable over the network via crafted HTTP requests to the affected device; the CVSS vector shows no privileges required and no user interaction. No authentication is needed per the advisory description.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, but EPSS is high at roughly 0.66 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Cisco Security Manager update referenced in the vendor advisory cisco-sa-csm-path-trav-NgeRnqgR.
• Restrict network access to the Security Manager management interface to trusted administrative networks.
• Place the interface behind a firewall or reverse proxy that normalizes and rejects traversal sequences in request paths.
• Audit and rotate any credentials or secrets stored on or reachable from the Security Manager host.
• Monitor vendor advisories for updated fixed versions since the record does not list affected releases.

Detection

• Inspect web server and proxy logs for requests containing ../ or encoded traversal sequences (for example %2e%2e%2f) to Security Manager endpoints.
• Alert on unexpected outbound or file-read activity from the Security Manager host, especially access to configuration or credential files.
• Baseline normal request paths and flag anomalous file-oriented parameters or unusually long path values.
• Correlate Security Manager access logs with authentication logs to identify unauthenticated requests reaching file-serving endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.