CVE-2025-20346
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The attacker would need valid read-only user credentials. This is due to improper role-based access control (RBAC).
Risk Assessment
The risk is the possibility of modifying policy configurations reserved for the Administrator role, which could lead to network security breaches or unauthorized changes.
Recommendation
It is recommended to apply patches provided by Cisco and review RBAC configurations to ensure roles have appropriate permissions. Also monitor logs for unauthorized changes.
Other vulnerabilities in Cisco Catalyst Center
See all- CVE-2026-20191High
A vulnerability in Cisco Catalyst Center allows an unauthenticated, remote attacker to read arbitrary files from a restricted container. The issue is due to insufficient validation of user-supplied input.
- CVE-2025-20353Medium
A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing execution of arbitrary script code or access to sensitive browser-based information.
- CVE-2025-20349Medium
A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This is due to insufficient validation of user-supplied input in REST API request parameters. The attacker must have valid credentials for an account with at least the Observer role.
Original NVD description (English source)
A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The attacker would need valid read-only user credentials. This vulnerability is due to improper role-based access control (RBAC). An attacker could exploit this vulnerability by logging in to an affected system and modifying certain policy configurations. A successful exploit could allow the attacker to modify policy configurations that are reserved for the Administrator role. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS