Plattform
cisco
Komponente
cisco-digital-network-architecture-center-dna-center
Behoben in
2.1.2
2.1.2
2.1.3
2.1.3
2.1.3
2.2.2
2.1.3
2.2.3
2.2.3
2.1.3
2.2.2
2.2.4
2.2.3
2.2.3
2.2.4
2.2.3
2.2.3
2.2.3
2.2.4
2.3.3
2.3.3
2.3.3
2.2.4
2.3.4
2.3.4
2.3.4
2.3.3
2.3.4
2.2.3
2.3.4
2.3.4
2.3.4
2.3.4
2.3.4
2.3.4
2.3.5
2.3.5
2.3.5
2.3.4
2.3.4
2.3.4
2.3.6
1.0.4
1.0.5
2.3.4
2.3.4
2.3.4
2.3.7
2.3.4
1.2.2
2.3.4
2.3.4
2.3.4
2.3.6
2.3.6
2.3.6
2.3.7
1.3.1
1.5.1
2.3.8
2.3.8
2.3.8
2.3.8
2.3.6
2.3.6
1.6.1
2.3.8
2.3.8
2.3.8
1.7.1
2.3.6
2.3.6
2.3.6
2.3.8
2.3.8
2.3.8
1.9.1
2.3.6
2.3.6
1.0.1
1.0.1
2.3.8
2.3.8
2.3.8
2.3.6
2.3.6
2.3.6
2.3.8
2.3.6
2.3.6
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
1.1.2
2.3.8
2.3.8
2.3.8
2.3.8
1.2.2
2.3.6
2.3.8
0.0.1
1.16.55
CVE-2025-20346 describes a privilege escalation vulnerability within Cisco DNA Center. This flaw allows an authenticated, remote attacker possessing valid read-only user credentials to execute operations typically restricted to Administrator roles. The vulnerability impacts versions 2.1.1.0 through VA Launchpad 1.9.0 and requires immediate attention to prevent unauthorized configuration changes.
Successful exploitation of CVE-2025-20346 allows an attacker to bypass role-based access controls (RBAC) and modify policy configurations intended only for administrators. This could lead to significant disruptions in network management, unauthorized policy enforcement, and potential compromise of network devices managed by Cisco DNA Center. The attacker's ability to alter critical configurations without proper authorization represents a serious security risk, potentially enabling them to manipulate network behavior and gain further access.
This CVE was publicly disclosed on 2025-11-13. The vulnerability's reliance on authenticated access suggests a lower probability of widespread exploitation compared to unauthenticated vulnerabilities, but the potential impact warrants prompt remediation. No public proof-of-concept (POC) code has been identified as of this date, but the relatively straightforward nature of the exploit could lead to its emergence. The vulnerability has not been added to the CISA KEV catalog.
Organizations heavily reliant on Cisco DNA Center for network management and automation are particularly at risk. Environments with a large number of read-only users or those with relaxed access control policies are also more vulnerable. Shared hosting environments utilizing Cisco DNA Center should be carefully assessed and secured.
• linux / server:
journalctl -u cisco-dna-center | grep -i "role-based access control"• generic web:
curl -I <dna_center_ip>/api/policy/configurations | grep -i "administrator privileges"disclosure
Exploit-Status
EPSS
0.07% (20% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-20346 is to upgrade Cisco DNA Center to a patched version as soon as it becomes available. Until a patch is applied, consider implementing stricter access controls to limit the scope of actions that read-only users can perform. Review existing policy configurations and monitor for any unauthorized modifications. While a direct WAF rule is unlikely to prevent this, segmenting network access to DNA Center can reduce the attack surface. After upgrade, confirm by verifying that users with read-only credentials can no longer modify administrator-reserved policy configurations.
Actualice Cisco Catalyst Center a una versión que no sea vulnerable. Consulte el advisory de Cisco para obtener más detalles e instrucciones específicas de actualización.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-20346 is a medium-severity vulnerability in Cisco DNA Center allowing authenticated attackers with read-only credentials to modify administrator-reserved policy configurations.
You are affected if you are running Cisco DNA Center versions 2.1.1.0–VA Launchpad 1.9.0 and have not upgraded to a patched version.
Upgrade Cisco DNA Center to a patched version as soon as it becomes available. Until then, implement stricter access controls and monitor policy configurations.
No active exploitation has been confirmed as of this date, but the vulnerability's simplicity could lead to exploitation.
Refer to the official Cisco Security Advisory for CVE-2025-20346 on the Cisco website (check Cisco's security advisories page for the latest information).
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.