CVE-2021-1303 — Incorrect Privilege Assignment in Cisco Catalyst Center

CWE-266 — Incorrect Privilege Assignment5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 61.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Catalyst CenterCisco Digital Network Architecture Center
Timeline
PublishedJan 20
Latest updateMay 24

Description

A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by authenticating as a user with an Observer role and executing commands on the affected device. A successful exploit could allow a user with the Observer role to execute commands to view diagnostic info…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/catalyst_center< 2.1.2.0

🔴Vulnerability Details

2
GHSA
GHSA-c27c-3q9w-fj4p: A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an↗2022-05-24
▶
CVEList
Cisco DNA Center Privilege Escalation Vulnerability↗2021-01-20
▶

📋Vendor Advisories

1
Cisco
Cisco DNA Center Privilege Escalation Vulnerability↗2021-01-20
▶

🕵️Threat Intelligence

1
Talos
Vulnerability Spotlight: Unsafe deserialization vulnerabilities in CODESYS Development System↗2021-07-26
▶
CVE-2021-1303 — Incorrect Privilege Assignment in Cisco | cvebase