CVE-2025-20223

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.7MEDIUM
EPSS
0.3%
top 49.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Catalyst CenterCisco Cisco Digital Network Architecture Center (dna Center)
Timeline
PublishedMay 7

Description

A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an affected device. This vulnerability is due to insufficient enforcement of access control on HTTP requests. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LExploitability: 1.2 | Impact: 3.4

Affected Packages2 packages

▶NVDcisco/catalyst_center< 2.3.7.7

🔴Vulnerability Details

2
CVEList
CVE-2025-20223: A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a reposi↗2025-05-07
▶
GHSA
GHSA-7fcv-r33w-mf96: A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a reposi↗2025-05-07
▶

📋Vendor Advisories

1
Cisco
Cisco Catalyst Center Insufficient Access Control Vulnerability↗2025-05-07
▶
CVE-2025-20223 (MEDIUM CVSS 4.7) | A vulnerability in Cisco Catalyst C | cvebase.io