PT-2025-46853 · Cisco · Cisco Catalyst Center

Published 2025-11-13 · Updated 2025-11-14 · CVE-2025-20349

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Catalyst Center (affected versions not specified)

Description A flaw exists in the REST API of Cisco Catalyst Center that could allow a remote attacker with valid credentials (at least Observer role) to execute arbitrary commands within a restricted container as the root user. This is caused by inadequate validation of input provided in REST API request parameters. An attacker could exploit this by sending a specially crafted API request to the device, potentially injecting and executing commands with root privileges inside a restricted container.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-16284

CVE-2025-20349

Affected Products

Cisco Catalyst Center

References · 7

• https://bdu.fstec.ru/vul/2025-16284 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20349 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20349 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1989138312120992193 · Twitter Post
• https://t.me/CVEtracker/37257 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2025111372 · Note