Platform
cisco
Component
cisco-digital-network-architecture-center-dna-center
Fixed in
2.1.2
2.1.2
2.1.3
2.1.3
2.1.3
2.2.2
2.1.3
2.2.3
2.2.3
2.1.3
2.2.2
2.2.4
2.2.3
2.2.3
2.2.4
2.2.3
2.2.3
2.2.3
2.2.4
2.3.3
2.3.3
2.3.3
2.2.4
2.3.4
2.3.4
2.3.4
2.3.3
2.3.4
2.2.3
2.3.4
2.3.4
2.3.4
2.3.4
2.3.4
2.3.4
2.3.5
2.3.5
2.3.5
2.3.4
2.3.4
2.3.4
2.3.6
1.0.4
1.0.5
2.3.4
2.3.4
2.3.4
2.3.7
2.3.4
1.2.2
2.3.4
2.3.4
2.3.4
2.3.6
2.3.6
2.3.6
2.3.7
1.3.1
1.5.1
2.3.8
2.3.8
2.3.8
2.3.8
2.3.6
2.3.6
1.6.1
2.3.8
2.3.8
2.3.8
1.7.1
2.3.6
2.3.6
2.3.6
2.3.8
2.3.8
2.3.8
1.9.1
2.3.6
2.3.6
1.0.1
1.0.1
2.3.8
2.3.8
2.3.8
2.3.6
2.3.6
2.3.6
2.3.8
2.3.6
2.3.6
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
2.3.8
1.1.2
2.3.8
2.3.8
2.3.8
2.3.8
1.2.2
2.3.6
2.3.8
0.0.1
1.16.55
CVE-2025-20346 describes a privilege escalation vulnerability within Cisco DNA Center. This flaw allows an authenticated, remote attacker possessing valid read-only user credentials to execute operations typically restricted to Administrator roles. The vulnerability impacts versions 2.1.1.0 through VA Launchpad 1.9.0 and requires immediate attention to prevent unauthorized configuration changes.
Successful exploitation of CVE-2025-20346 allows an attacker to bypass role-based access controls (RBAC) and modify policy configurations intended only for administrators. This could lead to significant disruptions in network management, unauthorized policy enforcement, and potential compromise of network devices managed by Cisco DNA Center. The attacker's ability to alter critical configurations without proper authorization represents a serious security risk, potentially enabling them to manipulate network behavior and gain further access.
This CVE was publicly disclosed on 2025-11-13. The vulnerability's reliance on authenticated access suggests a lower probability of widespread exploitation compared to unauthenticated vulnerabilities, but the potential impact warrants prompt remediation. No public proof-of-concept (POC) code has been identified as of this date, but the relatively straightforward nature of the exploit could lead to its emergence. The vulnerability has not been added to the CISA KEV catalog.
Exploit Status
EPSS
0.07% (20% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-20346 is to upgrade Cisco DNA Center to a patched version as soon as it becomes available. Until a patch is applied, consider implementing stricter access controls to limit the scope of actions that read-only users can perform. Review existing policy configurations and monitor for any unauthorized modifications. While a direct WAF rule is unlikely to prevent this, segmenting network access to DNA Center can reduce the attack surface. After upgrade, confirm by verifying that users with read-only credentials can no longer modify administrator-reserved policy configurations.
Actualice Cisco Catalyst Center a una versión que no sea vulnerable. Consulte el advisory de Cisco para obtener más detalles e instrucciones específicas de actualización.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-20346 is a medium-severity vulnerability in Cisco DNA Center allowing authenticated attackers with read-only credentials to modify administrator-reserved policy configurations.
You are affected if you are running Cisco DNA Center versions 2.1.1.0–VA Launchpad 1.9.0 and have not upgraded to a patched version.
Upgrade Cisco DNA Center to a patched version as soon as it becomes available. Until then, implement stricter access controls and monitor policy configurations.
No active exploitation has been confirmed as of this date, but the vulnerability's simplicity could lead to exploitation.
Refer to the official Cisco Security Advisory for CVE-2025-20346 on the Cisco website (check Cisco's security advisories page for the latest information).
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.