This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco Catalyst Center fixes 5 vulnerabilities

Cisco fixes 5 vulnerabilities in the Cisco Catalyst Center product with versions 2.3.7.10 and 2.3.7.10-VA. The most serious of them are described below [1][2][3]; the remaining ones can be found at [4][5].

Cisco Catalyst Center Virtual Appliance - privilege escalation (CVE-2025-20341)
CVSS 8.8 (High)

Due to insufficient validation of user input in Cisco Catalyst Center Virtual Appliance, an authenticated remote attacker with the Observer role or higher can, by means of a specially crafted HTTP request, modify the affected system without authorization, create new users or elevate their privileges to the Administrator role [1].

The vulnerability is present in product:

  • Cisco Catalyst Center; >=2.3.7.3-VA, <2.3.7.10-VA;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 11. 2025.

Cisco Catalyst Center - command execution (CVE-2025-20349)
CVSS 6.3 (Medium)

Due to insufficient validation of user input in the Cisco Catalyst Center REST API, an authenticated remote attacker with the Observer role or higher can execute commands with root privileges within a restricted container by sending specially crafted API requests [2].

The vulnerability is present in product:

  • Cisco Catalyst Center; <2.3.7.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

More information:

  • CVE-2025-20349 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.

Cisco Catalyst Center - XSS (CVE-2025-20353)
CVSS 6.1 (Medium)

Due to insufficient validation of user input in Cisco Catalyst Center, an unauthenticated remote attacker can carry out an XSS attack [3].

The vulnerability is present in product:

  • Cisco Catalyst Center; <2.3.7.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20353 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 11. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 14. 11. 2025.

CESNET, z.s.p.o. Logo