CVE-2025-20223
A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an aff
Description
A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an affected device. This vulnerability is due to insufficient enforcement of access control on HTTP requests. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Catalyst Center (DNA Center) | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Digital Network Architecture Center (DNA Center)
Vendor advisory
cisco-sa-catc-insec-acc-mtt8EhEb
Cisco Catalyst Center Insufficient Access Control Vulnerability
Cisco’s rating: Medium (advisory CVSS 4.7) · Published May 7, 2025
Bug ID: CSCwk27721
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from