CVE-2025-20349
Published: 13 November 2025
Description
A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This vulnerability is due to insufficient validation of user-supplied input in REST…
more
API request parameters. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to inject arbitrary commands that would then be executed in a restricted container with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Observer.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of user-supplied input in REST API request parameters to prevent OS command injection exploits.
Mandates identification, reporting, and correction of flaws like this command injection vulnerability through timely patching.
Enforces least privilege for Observer role users, limiting the access and potential impact of injected commands executed as root in the restricted container.
Security SummaryAI
CVE-2025-20349 is a vulnerability in the REST API of Cisco Catalyst Center that stems from insufficient validation of user-supplied input in REST API request parameters. This flaw, classified under CWE-78 (OS Command Injection), enables an authenticated, remote attacker to execute arbitrary commands within a restricted container running as the root user. The vulnerability affects Cisco Catalyst Center deployments and was published on 2025-11-13 with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker can exploit this vulnerability by sending a crafted API request to an affected device, provided they possess valid credentials for a user account with at least the Observer role. Successful exploitation allows the injection and execution of arbitrary commands in the restricted container with root privileges, potentially leading to limited confidentiality, integrity, and availability impacts as per the CVSS vector.
For mitigation details, including available patches and workarounds, refer to the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables exploitation of public-facing REST API (T1190) for authenticated OS command injection (T1059.004) in a root container.