CVE-2025-20349

CWE-78 — OS Command Injection4 documents4 sources
Severity
8.8HIGH
EPSS
0.2%
top 60.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Catalyst CenterCisco Cisco Digital Network Architecture Center (dna Center)
Timeline
PublishedNov 13

Description

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restr…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDcisco/catalyst_center< 2.3.7.10

🔴Vulnerability Details

2
CVEList
Cisco DNA Center API Command Injection Vulnerability↗2025-11-13
▶
GHSA
GHSA-wmwj-gg73-vv5m: A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted c↗2025-11-13
▶

📋Vendor Advisories

1
Cisco
Cisco Catalyst Center REST API Command Injection Vulnerability↗2025-11-13
▶