PT-2021-1839 · Cisco · Cisco Dna Center

Published 2021-01-20 · Updated 2025-07-23 · CVE-2021-1303

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DNA Center (affected versions not specified)

Description The issue is related to improper enforcement of actions for assigned user roles in the user management service. This could allow a remote attacker to execute unauthorized commands on an affected device. An attacker could exploit this by authenticating as a user with an Observer role and then executing commands, potentially allowing them to view diagnostic information of managed devices.

Recommendations For all affected versions, consider restricting the privileges of the Observer role to prevent unauthorized command execution until a patch is available. As a temporary workaround, limit the actions that can be performed by users with the Observer role to minimize the risk of exploitation.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2021-00599

CVE-2021-1303

Affected Products

Cisco Dna Center

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1303 · Security Note
• https://bdu.fstec.ru/vul/2021-00599 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-privesc-6qjA3hVh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1303 · Vendor Advisory
• https://t.me/cveNotify/129991 · Telegram Post