cvelistv5 - cve-2025-20349

CVE-2025-20349 (GCVE-0-2025-20349)

Vulnerability from cvelistv5

Published

2025-11-13 16:18

Modified

2025-11-14 04:55

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.

References

URL

Tags

psirt@cisco.com

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Digital Network Architecture Center (DNA Center)	Version: 1.4.0.0 Version: 2.1.1.0 Version: 2.1.1.3 Version: 2.1.2.0 Version: 2.1.2.3 Version: 2.1.2.4 Version: 2.1.2.5 Version: 2.2.1.0 Version: 2.1.2.6 Version: 2.2.2.0 Version: 2.2.2.1 Version: 2.2.2.3 Version: 2.1.2.7 Version: 2.2.1.3 Version: 2.2.3.0 Version: 2.2.2.4 Version: 2.2.2.5 Version: 2.2.3.3 Version: 2.2.2.7 Version: 2.2.2.6 Version: 2.2.2.8 Version: 2.2.3.4 Version: 2.1.2.8 Version: 2.3.2.1 Version: 2.3.2.1-AIRGAP Version: 2.3.2.1-AIRGAP-CA Version: 2.2.3.5 Version: 2.3.3.0 Version: 2.3.3.3 Version: 2.3.3.1-AIRGAP Version: 2.3.3.1 Version: 2.3.2.3 Version: 2.3.3.3-AIRGAP Version: 2.2.3.6 Version: 2.2.2.9 Version: 2.3.3.0-AIRGAP Version: 2.3.3.3-AIRGAP-CA Version: 2.3.3.4 Version: 2.3.3.4-AIRGAP Version: 2.3.3.4-AIRGAP-MDNAC Version: 2.3.3.4-HF1 Version: 2.3.4.0 Version: 2.3.3.5 Version: 2.3.3.5-AIRGAP Version: 2.3.4.0-AIRGAP Version: 2.3.4.3 Version: 2.3.4.3-AIRGAP Version: 2.3.3.6 Version: 2.3.5.0 Version: 2.3.3.6-AIRGAP Version: 2.3.5.0-AIRGAP Version: 2.3.3.6-AIRGAP-MDNAC Version: 2.3.5.0-AIRGAP-MDNAC Version: 2.3.3.7 Version: 2.3.3.7-AIRGAP Version: 2.3.3.7-AIRGAP-MDNAC Version: 2.3.6.0 Version: 2.3.3.6-70045-HF1 Version: 2.3.3.7-72328-AIRGAP Version: 2.3.3.7-72323 Version: 2.3.3.7-72328-MDNAC Version: 2.3.5.3 Version: 2.3.5.3-AIRGAP-MDNAC Version: 2.3.5.3-AIRGAP Version: 2.3.6.0-AIRGAP Version: 2.3.7.0 Version: 2.3.7.0-AIRGAP Version: 2.3.7.0-AIRGAP-MDNAC Version: 2.3.7.0-VA Version: 2.3.5.4 Version: 2.3.5.4-AIRGAP Version: 2.3.5.4-AIRGAP-MDNAC Version: 2.3.7.3 Version: 2.3.7.3-AIRGAP Version: 2.3.7.3-AIRGAP-MDNAC Version: 2.3.5.5-AIRGAP Version: 2.3.5.5 Version: 2.3.5.5-AIRGAP-MDNAC Version: 2.3.7.4 Version: 2.3.7.4-AIRGAP Version: 2.3.7.4-AIRGAP-MDNAC Version: 2.3.7.5-AIRGAP Version: 2.3.7.5-VA Version: 2.3.5.6-AIRGAP Version: 2.3.5.6 Version: 2.3.5.6-AIRGAP-MDNAC Version: 1.0.0.0 Version: 2.3.7.6-AIRGAP Version: 2.3.7.6 Version: 2.3.7.6-VA Version: 2.3.5.5-70026-HF70 Version: 2.3.5.5-70026-HF51 Version: 2.3.5.6-70143-HF20 Version: 2.3.7.6-AIRGAP-MDNAC Version: 2.3.5.5-70026-HF52 Version: 2.3.5.5-70026-HF53 Version: 2.3.5.5-70026-HF71 Version: 2.3.7.7 Version: 2.3.7.7-VA Version: 2.3.7.7-AIRGAP Version: 2.3.7.7-AIRGAP-MDNAC Version: 2.3.5.5-70026-HF72 Version: 2.3.7.9-VA Version: 2.3.7.9 Version: 2.3.7.9-AIRGAP Version: 2.3.7.9-AIRGAP-MDNAC Version: 2.3.7.9-70301-SMU1 Version: 2.3.5.3-EULA Version: 0.0.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-14T04:55:36.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Digital Network Architecture Center (DNA Center)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0.0"
            },
            {
              "status": "affected",
              "version": "2.1.1.0"
            },
            {
              "status": "affected",
              "version": "2.1.1.3"
            },
            {
              "status": "affected",
              "version": "2.1.2.0"
            },
            {
              "status": "affected",
              "version": "2.1.2.3"
            },
            {
              "status": "affected",
              "version": "2.1.2.4"
            },
            {
              "status": "affected",
              "version": "2.1.2.5"
            },
            {
              "status": "affected",
              "version": "2.2.1.0"
            },
            {
              "status": "affected",
              "version": "2.1.2.6"
            },
            {
              "status": "affected",
              "version": "2.2.2.0"
            },
            {
              "status": "affected",
              "version": "2.2.2.1"
            },
            {
              "status": "affected",
              "version": "2.2.2.3"
            },
            {
              "status": "affected",
              "version": "2.1.2.7"
            },
            {
              "status": "affected",
              "version": "2.2.1.3"
            },
            {
              "status": "affected",
              "version": "2.2.3.0"
            },
            {
              "status": "affected",
              "version": "2.2.2.4"
            },
            {
              "status": "affected",
              "version": "2.2.2.5"
            },
            {
              "status": "affected",
              "version": "2.2.3.3"
            },
            {
              "status": "affected",
              "version": "2.2.2.7"
            },
            {
              "status": "affected",
              "version": "2.2.2.6"
            },
            {
              "status": "affected",
              "version": "2.2.2.8"
            },
            {
              "status": "affected",
              "version": "2.2.3.4"
            },
            {
              "status": "affected",
              "version": "2.1.2.8"
            },
            {
              "status": "affected",
              "version": "2.3.2.1"
            },
            {
              "status": "affected",
              "version": "2.3.2.1-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.2.1-AIRGAP-CA"
            },
            {
              "status": "affected",
              "version": "2.2.3.5"
            },
            {
              "status": "affected",
              "version": "2.3.3.0"
            },
            {
              "status": "affected",
              "version": "2.3.3.3"
            },
            {
              "status": "affected",
              "version": "2.3.3.1-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.1"
            },
            {
              "status": "affected",
              "version": "2.3.2.3"
            },
            {
              "status": "affected",
              "version": "2.3.3.3-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.2.3.6"
            },
            {
              "status": "affected",
              "version": "2.2.2.9"
            },
            {
              "status": "affected",
              "version": "2.3.3.0-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.3-AIRGAP-CA"
            },
            {
              "status": "affected",
              "version": "2.3.3.4"
            },
            {
              "status": "affected",
              "version": "2.3.3.4-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.4-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.3.4-HF1"
            },
            {
              "status": "affected",
              "version": "2.3.4.0"
            },
            {
              "status": "affected",
              "version": "2.3.3.5"
            },
            {
              "status": "affected",
              "version": "2.3.3.5-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.4.0-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.4.3"
            },
            {
              "status": "affected",
              "version": "2.3.4.3-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.6"
            },
            {
              "status": "affected",
              "version": "2.3.5.0"
            },
            {
              "status": "affected",
              "version": "2.3.3.6-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.5.0-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.6-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.0-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.3.7"
            },
            {
              "status": "affected",
              "version": "2.3.3.7-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.7-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.6.0"
            },
            {
              "status": "affected",
              "version": "2.3.3.6-70045-HF1"
            },
            {
              "status": "affected",
              "version": "2.3.3.7-72328-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.3.7-72323"
            },
            {
              "status": "affected",
              "version": "2.3.3.7-72328-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.3"
            },
            {
              "status": "affected",
              "version": "2.3.5.3-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.3-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.6.0-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.0"
            },
            {
              "status": "affected",
              "version": "2.3.7.0-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.0-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.7.0-VA"
            },
            {
              "status": "affected",
              "version": "2.3.5.4"
            },
            {
              "status": "affected",
              "version": "2.3.5.4-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.5.4-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.7.3"
            },
            {
              "status": "affected",
              "version": "2.3.7.3-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.3-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.5.5"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.7.4"
            },
            {
              "status": "affected",
              "version": "2.3.7.4-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.4-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.7.5-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.5-VA"
            },
            {
              "status": "affected",
              "version": "2.3.5.6-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.5.6"
            },
            {
              "status": "affected",
              "version": "2.3.5.6-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "1.0.0.0"
            },
            {
              "status": "affected",
              "version": "2.3.7.6-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.6"
            },
            {
              "status": "affected",
              "version": "2.3.7.6-VA"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF70"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF51"
            },
            {
              "status": "affected",
              "version": "2.3.5.6-70143-HF20"
            },
            {
              "status": "affected",
              "version": "2.3.7.6-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF52"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF53"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF71"
            },
            {
              "status": "affected",
              "version": "2.3.7.7"
            },
            {
              "status": "affected",
              "version": "2.3.7.7-VA"
            },
            {
              "status": "affected",
              "version": "2.3.7.7-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.7-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.5.5-70026-HF72"
            },
            {
              "status": "affected",
              "version": "2.3.7.9-VA"
            },
            {
              "status": "affected",
              "version": "2.3.7.9"
            },
            {
              "status": "affected",
              "version": "2.3.7.9-AIRGAP"
            },
            {
              "status": "affected",
              "version": "2.3.7.9-AIRGAP-MDNAC"
            },
            {
              "status": "affected",
              "version": "2.3.7.9-70301-SMU1"
            },
            {
              "status": "affected",
              "version": "2.3.5.3-EULA"
            },
            {
              "status": "affected",
              "version": "0.0.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-13T16:27:31.359Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-dnac-ci-ZWLQVSwT",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT"
        }
      ],
      "source": {
        "advisory": "cisco-sa-dnac-ci-ZWLQVSwT",
        "defects": [
          "CSCwo77762"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco DNA Center API Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20349",
    "datePublished": "2025-11-13T16:18:03.689Z",
    "dateReserved": "2024-10-10T19:15:13.257Z",
    "dateUpdated": "2025-11-14T04:55:36.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20349\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-11-13T17:15:45.817\",\"lastModified\":\"2025-11-14T16:42:03.187\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\\r\\n\\r\\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT\",\"source\":\"psirt@cisco.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20349\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-13T17:10:12.559868Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-13T17:10:25.962Z\"}}], \"cna\": {\"title\": \"Cisco DNA Center API Command Injection Vulnerability\", \"source\": {\"defects\": [\"CSCwo77762\"], \"advisory\": \"cisco-sa-dnac-ci-ZWLQVSwT\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Digital Network Architecture Center (DNA Center)\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.4.0.0\"}, {\"status\": \"affected\", \"version\": \"2.1.1.0\"}, {\"status\": \"affected\", \"version\": \"2.1.1.3\"}, {\"status\": \"affected\", \"version\": \"2.1.2.0\"}, {\"status\": \"affected\", \"version\": \"2.1.2.3\"}, {\"status\": \"affected\", \"version\": \"2.1.2.4\"}, {\"status\": \"affected\", \"version\": \"2.1.2.5\"}, {\"status\": \"affected\", \"version\": \"2.2.1.0\"}, {\"status\": \"affected\", \"version\": \"2.1.2.6\"}, {\"status\": \"affected\", \"version\": \"2.2.2.0\"}, {\"status\": \"affected\", \"version\": \"2.2.2.1\"}, {\"status\": \"affected\", \"version\": \"2.2.2.3\"}, {\"status\": \"affected\", \"version\": \"2.1.2.7\"}, {\"status\": \"affected\", \"version\": \"2.2.1.3\"}, {\"status\": \"affected\", \"version\": \"2.2.3.0\"}, {\"status\": \"affected\", \"version\": \"2.2.2.4\"}, {\"status\": \"affected\", \"version\": \"2.2.2.5\"}, {\"status\": \"affected\", \"version\": \"2.2.3.3\"}, {\"status\": \"affected\", \"version\": \"2.2.2.7\"}, {\"status\": \"affected\", \"version\": \"2.2.2.6\"}, {\"status\": \"affected\", \"version\": \"2.2.2.8\"}, {\"status\": \"affected\", \"version\": \"2.2.3.4\"}, {\"status\": \"affected\", \"version\": \"2.1.2.8\"}, {\"status\": \"affected\", \"version\": \"2.3.2.1\"}, {\"status\": \"affected\", \"version\": \"2.3.2.1-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.2.1-AIRGAP-CA\"}, {\"status\": \"affected\", \"version\": \"2.2.3.5\"}, {\"status\": \"affected\", \"version\": \"2.3.3.0\"}, {\"status\": \"affected\", \"version\": \"2.3.3.3\"}, {\"status\": \"affected\", \"version\": \"2.3.3.1-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.1\"}, {\"status\": \"affected\", \"version\": \"2.3.2.3\"}, {\"status\": \"affected\", \"version\": \"2.3.3.3-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.2.3.6\"}, {\"status\": \"affected\", \"version\": \"2.2.2.9\"}, {\"status\": \"affected\", \"version\": \"2.3.3.0-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.3-AIRGAP-CA\"}, {\"status\": \"affected\", \"version\": \"2.3.3.4\"}, {\"status\": \"affected\", \"version\": \"2.3.3.4-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.4-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.3.4-HF1\"}, {\"status\": \"affected\", \"version\": \"2.3.4.0\"}, {\"status\": \"affected\", \"version\": \"2.3.3.5\"}, {\"status\": \"affected\", \"version\": \"2.3.3.5-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.4.0-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.4.3\"}, {\"status\": \"affected\", \"version\": \"2.3.4.3-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.6\"}, {\"status\": \"affected\", \"version\": \"2.3.5.0\"}, {\"status\": \"affected\", \"version\": \"2.3.3.6-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.5.0-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.6-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.0-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.6.0\"}, {\"status\": \"affected\", \"version\": \"2.3.3.6-70045-HF1\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7-72328-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7-72323\"}, {\"status\": \"affected\", \"version\": \"2.3.3.7-72328-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.3\"}, {\"status\": \"affected\", \"version\": \"2.3.5.3-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.3-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.6.0-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.0\"}, {\"status\": \"affected\", \"version\": \"2.3.7.0-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.0-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.7.0-VA\"}, {\"status\": \"affected\", \"version\": \"2.3.5.4\"}, {\"status\": \"affected\", \"version\": \"2.3.5.4-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.5.4-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.7.3\"}, {\"status\": \"affected\", \"version\": \"2.3.7.3-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.3-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.7.4\"}, {\"status\": \"affected\", \"version\": \"2.3.7.4-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.4-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.7.5-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.5-VA\"}, {\"status\": \"affected\", \"version\": \"2.3.5.6-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.5.6\"}, {\"status\": \"affected\", \"version\": \"2.3.5.6-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"1.0.0.0\"}, {\"status\": \"affected\", \"version\": \"2.3.7.6-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.6\"}, {\"status\": \"affected\", \"version\": \"2.3.7.6-VA\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF70\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF51\"}, {\"status\": \"affected\", \"version\": \"2.3.5.6-70143-HF20\"}, {\"status\": \"affected\", \"version\": \"2.3.7.6-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF52\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF53\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF71\"}, {\"status\": \"affected\", \"version\": \"2.3.7.7\"}, {\"status\": \"affected\", \"version\": \"2.3.7.7-VA\"}, {\"status\": \"affected\", \"version\": \"2.3.7.7-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.7-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.5.5-70026-HF72\"}, {\"status\": \"affected\", \"version\": \"2.3.7.9-VA\"}, {\"status\": \"affected\", \"version\": \"2.3.7.9\"}, {\"status\": \"affected\", \"version\": \"2.3.7.9-AIRGAP\"}, {\"status\": \"affected\", \"version\": \"2.3.7.9-AIRGAP-MDNAC\"}, {\"status\": \"affected\", \"version\": \"2.3.7.9-70301-SMU1\"}, {\"status\": \"affected\", \"version\": \"2.3.5.3-EULA\"}, {\"status\": \"affected\", \"version\": \"0.0.0.0\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT\", \"name\": \"cisco-sa-dnac-ci-ZWLQVSwT\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\\r\\n\\r\\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-78\", \"description\": \"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-11-13T16:27:31.359Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20349\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-14T04:55:36.331Z\", \"dateReserved\": \"2024-10-10T19:15:13.257Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-11-13T16:18:03.689Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ghsa-wmwj-gg73-vv5m

Vulnerability from github

Published

2025-11-13 18:31

Modified

2025-11-13 18:31

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.

This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-20349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-13T17:15:45Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\n\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.",
  "id": "GHSA-wmwj-gg73-vv5m",
  "modified": "2025-11-13T18:31:05Z",
  "published": "2025-11-13T18:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20349"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

ncsc-2025-0365

Vulnerability from csaf_ncscnl

Published

2025-11-14 12:55

Modified

2025-11-14 12:55

Summary

Kwetsbaarheden verholpen in Cisco Catalyst Center

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Cisco heeft kwetsbaarheden verholpen in Cisco Catalyst Center.

Interpretaties

Deze kwetsbaarheid met kenmerk CVE-2025-20341, ontstaat door onvoldoende validatie van gebruikersinvoer. Een kwaadwillende kan dit misbruiken, door een speciaal vervaardigd HTTP‑verzoek te versturen, waardoor ongeautoriseerde systeemwijzigingen mogelijk worden, zoals het aanmaken van accounts of het verhogen van eigen rechten. De kwetsbaarheid met kenmerk CVE-2025-20353, kan een niet-geauthenticeerde, externe aanvaller in staat stellen om een cross-site scripting (XSS)-aanval uit te voeren. Deze kwetsbaarheid wordt veroorzaakt door onvoldoende validatie van gebruikersinvoer. Door een gebruiker te laten klikken op een speciaal gemaakte link, kan de aanvaller willekeurige code uitvoeren of toegang krijgen tot gevoelige browserinformatie. De kwetsbaarheid met kenmerk CVE-2025-20346 kan een geauthenticeerde, externe aanvaller in staat stellen om handelingen uit te voeren die normaal Administrator‑rechten vereisen. De aanvaller heeft hiervoor geldige read-only gebruikersgegevens nodig. Deze kwetsbaarheid ontstaat door onjuiste rolgebaseerde toegangscontrole (RBAC). Een aanvaller kan hiervan misbruik maken door in te loggen op een getroffen systeem en bepaalde beleidsconfiguraties aan te passen. De kwetsbaarheid met kenmerk CVE-2025-20349, in de REST API van Cisco Catalyst Center maakt het een geauthenticeerde aanvaller mogelijk om willekeurige opdrachten als root uit te voeren in een beperkte container door een speciaal vervaardigd API-verzoek te versturen.

Oplossingen

Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-284

Improper Access Control

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-269

Improper Privilege Management

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft kwetsbaarheden verholpen in Cisco Catalyst Center.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Deze kwetsbaarheid met kenmerk CVE-2025-20341, ontstaat door onvoldoende validatie van gebruikersinvoer. Een kwaadwillende kan dit misbruiken, door een speciaal vervaardigd HTTP\u2011verzoek te versturen, waardoor ongeautoriseerde systeemwijzigingen mogelijk worden, zoals het aanmaken van accounts of het verhogen van eigen rechten.\n\nDe kwetsbaarheid met kenmerk CVE-2025-20353, kan een niet-geauthenticeerde, externe aanvaller in staat stellen om een cross-site scripting (XSS)-aanval uit te voeren. Deze kwetsbaarheid wordt veroorzaakt door onvoldoende validatie van gebruikersinvoer. Door een gebruiker te laten klikken op een speciaal gemaakte link, kan de aanvaller willekeurige code uitvoeren of toegang krijgen tot gevoelige browserinformatie. \n\nDe kwetsbaarheid met kenmerk CVE-2025-20346 kan een geauthenticeerde, externe aanvaller in staat stellen om handelingen uit te voeren die normaal Administrator\u2011rechten vereisen. De aanvaller heeft hiervoor geldige read-only gebruikersgegevens nodig. Deze kwetsbaarheid ontstaat door onjuiste rolgebaseerde toegangscontrole (RBAC). Een aanvaller kan hiervan misbruik maken door in te loggen op een getroffen systeem en bepaalde beleidsconfiguraties aan te passen.\n\nDe kwetsbaarheid met kenmerk CVE-2025-20349, in de REST API van Cisco Catalyst Center maakt het een geauthenticeerde aanvaller mogelijk om willekeurige opdrachten als root uit te voeren in een beperkte container door een speciaal vervaardigd API-verzoek te versturen. ",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
        "title": "CWE-78"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-priv-esc-VS8EeCuX"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-xss-weXtVZ59"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-privesc-catc-rYjReeLU"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Cisco Catalyst Center",
    "tracking": {
      "current_release_date": "2025-11-14T12:55:27.227262Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0365",
      "initial_release_date": "2025-11-14T12:55:27.227262Z",
      "revision_history": [
        {
          "date": "2025-11-14T12:55:27.227262Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Catalyst"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20353",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "A vulnerability in Cisco Catalyst Center\u0027s web-based management interface allows unauthenticated remote attackers to exploit insufficient user input validation, enabling cross-site scripting (XSS) attacks that could execute arbitrary scripts or access sensitive data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20353 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20353.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-20353"
    },
    {
      "cve": "CVE-2025-20349",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "A vulnerability in the REST API of Cisco Catalyst Center allows authenticated remote attackers to execute arbitrary commands as the root user due to insufficient input validation in API request parameters.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20349 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20349.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-20349"
    },
    {
      "cve": "CVE-2025-20346",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Privilege Management",
          "title": "CWE-269"
        },
        {
          "category": "description",
          "text": "A vulnerability in Cisco Catalyst Center allows authenticated remote attackers with read-only credentials to perform actions requiring Administrator privileges due to improper role-based access control.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20346 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20346.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-20346"
    },
    {
      "cve": "CVE-2025-20341",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Cisco Catalyst Center Virtual Appliance allows authenticated remote attackers to elevate privileges to Administrator by exploiting insufficient validation of user-supplied input via crafted HTTP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20341 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20341.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-20341"
    }
  ]
}

cisco-sa-dnac-ci-zwlqvswt

Vulnerability from csaf_cisco

Published

2025-11-13 16:00

Modified

2025-11-13 16:00

Summary

Cisco Catalyst Center REST API Command Injection Vulnerability

Notes

Summary

Vulnerable Products

At the time of publication, this vulnerability affected Cisco Catalyst Center, both virtual and hardware appliances, regardless of device configuration. For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.

Workarounds

There are no workarounds that address this vulnerability.

Fixed Software

Cisco considers any workarounds and mitigations to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. Fixed Releases At the time of publication, the release information in the following table was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information. The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability that is described in this advisory and which release included the fix for this vulnerability. Cisco Catalyst Center Release First Fixed Release 2.3.7 and earlier 2.3.7.10 3.1 Not affected The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Vulnerability Policy

To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

This vulnerability was found during internal security testing.

Legal Disclaimer

SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT The Cisco Support and Downloads ["https://www.cisco.com/c/en/us/support/index.html"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid. Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories ["https://www.cisco.com/go/psirt"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] or their contracted maintenance providers. LEGAL DISCLAIMER DETAILS CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories ["https://www.cisco.com/go/psirt"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] for more information.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "summary": "This vulnerability was found during internal security testing."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "At the time of publication, this vulnerability affected Cisco Catalyst Center, both virtual and hardware appliances, regardless of device configuration.\r\n\r\nFor information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software [\"#fs\"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco considers any workarounds and mitigations to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n      Fixed Releases\r\nAt the time of publication, the release information in the following table was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.\r\n\r\nThe left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability that is described in this advisory and which release included the fix for this vulnerability.\r\n        Cisco Catalyst Center Release  First Fixed Release          2.3.7 and earlier  2.3.7.10      3.1  Not affected\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "This vulnerability was found during internal security testing.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n    LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Catalyst Center REST API Command Injection Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "the advisories",
        "url": "https://www.cisco.com/go/psirt"
      }
    ],
    "title": "Cisco Catalyst Center REST API Command Injection Vulnerability",
    "tracking": {
      "current_release_date": "2025-11-13T16:00:00+00:00",
      "generator": {
        "date": "2025-11-13T15:56:09+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-dnac-ci-ZWLQVSwT",
      "initial_release_date": "2025-11-13T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2025-11-13T15:55:55+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Digital Network Architecture Center (DNA Center)",
            "product": {
              "name": "Cisco Digital Network Architecture Center (DNA Center) ",
              "product_id": "CSAFPID-233151"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20349",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwo77762"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-233151"
        ]
      },
      "release_date": "2025-11-13T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-233151"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-233151"
          ]
        }
      ],
      "title": "Cisco DNA Center API Command Injection Vulnerability"
    }
  ]
}

fkie_cve-2025-20349

Vulnerability from fkie_nvd

Published

2025-11-13 17:15

Modified

2025-11-14 16:42

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer."
    }
  ],
  "id": "CVE-2025-20349",
  "lastModified": "2025-11-14T16:42:03.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "psirt@cisco.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-11-13T17:15:45.817",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-20349 (GCVE-0-2025-20349)

Vulnerability from cvelistv5

ghsa-wmwj-gg73-vv5m

Vulnerability from github

ncsc-2025-0365

Vulnerability from csaf_ncscnl

cisco-sa-dnac-ci-zwlqvswt

Vulnerability from csaf_cisco

fkie_cve-2025-20349

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature