PT-2024-2568 · Cisco · Cisco Catalyst Center

Published 2024-03-27 · Updated 2025-07-23 · CVE-2024-20333

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Catalyst Center (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an authenticated, remote attacker to change specific data within the interface on an affected device. This issue is due to insufficient authorization enforcement, allowing an attacker to exploit it by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to change a specific field within the web-based management interface, even though they should not have access to change that field.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2024-02606

CVE-2024-20333

Affected Products

Cisco Catalyst Center

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccc-authz-bypass-5EKchJRb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20333 · Security Note
• https://bdu.fstec.ru/vul/2024-02606 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20333 · Vendor Advisory
• https://twitter.com/CVEnew/status/1773096363632599092 · Twitter Post
• https://twitter.com/RedPacketSec/status/1773291433719410703 · Twitter Post
• https://t.me/cveNotify/129980 · Telegram Post