Cisco

A critical security vulnerability (CVE-2025-20341) was discovered in the **Cisco Catalyst Center Virtual Appliance** running on **VMware ESXi**, allowing authenticated attackers with **Observer-level credentials** to escalate privileges to **Administrator** via crafted HTTP requests. The flaw stems from insufficient input validation, enabling unauthorized system modifications such as creating new accounts or elevating privileges. While no evidence of exploitation exists yet, the vulnerability poses a severe risk as it **expands the attack surface**—no initial admin access is required, and **no workarounds** are available. Affected versions include **2.3.7.3-VA and later (excluding 3.1)**, requiring an urgent upgrade to **2.3.7.10-VA or newer**. The issue was internally identified by Cisco’s TAC, emphasizing the need for immediate patching to prevent potential privilege abuse and administrative compromise. Failure to act could lead to **unauthorized control over critical network infrastructure**, though no data breaches or financial losses have been reported to date.

Source: https://gbhackers.com/cisco-catalyst-center/

Cisco cybersecurity rating report: https://www.rankiteo.com/company/cisco

"id": "CIS4992749111425",
"linkid": "cisco",
"type": "Vulnerability",
"date": "6/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Networking Hardware/Software',
                        'location': 'Global',
                        'name': 'Cisco Systems',
                        'size': 'Large Enterprise',
                        'type': 'Corporation'}],
 'attack_vector': ['Network', 'Authenticated Remote'],
 'customer_advisories': ['Urgent upgrade notice for affected versions'],
 'description': 'A critical security vulnerability (CVE-2025-20341) in the '
                'Cisco Catalyst Center Virtual Appliance could enable '
                'authenticated, remote attackers with at least Observer-level '
                'privileges to escalate their access to Administrator via '
                'crafted HTTP requests due to insufficient input validation. '
                'The vulnerability affects only virtual appliances deployed on '
                'VMware ESXi, with no workarounds available. Immediate '
                'patching to fixed software versions (e.g., 2.3.7.10-VA or '
                'later) is required. No evidence of in-the-wild exploitation '
                'has been reported as of the advisory.',
 'impact': {'brand_reputation_impact': ['Potential reputational risk if '
                                        'exploited'],
            'operational_impact': ['Potential unauthorized administrative '
                                   'access',
                                   'Risk of account creation/privilege '
                                   'elevation'],
            'systems_affected': ['Cisco Catalyst Center Virtual Appliances on '
                                 'VMware ESXi (versions 2.3.7.3-VA and later, '
                                 'excluding 3.1+)']},
 'investigation_status': 'Internally discovered (via TAC support case); no '
                         'evidence of exploitation in the wild.',
 'lessons_learned': ['Proactive internal vulnerability discovery (via TAC) '
                     'highlights the importance of rigorous code review.',
                     'Lack of workarounds underscores the need for timely '
                     'patch management in critical infrastructure.',
                     'Observer-level accounts can serve as attack vectors; '
                     'least-privilege principles must be enforced.'],
 'post_incident_analysis': {'corrective_actions': ['Software patch (input '
                                                   'validation fixes) released '
                                                   'in versions 2.3.7.10-VA '
                                                   'and later'],
                            'root_causes': ['Insufficient validation of '
                                            'user-supplied input in HTTP '
                                            'requests']},
 'recommendations': ['Upgrade affected Cisco Catalyst Center Virtual '
                     'Appliances to version 2.3.7.10-VA or later immediately.',
                     'Audit user roles to minimize Observer-level access where '
                     'unnecessary.',
                     'Monitor for unusual privilege escalation attempts or '
                     'unauthorized account creation.',
                     'Subscribe to vendor security advisories (e.g., Cisco '
                     'PSIRT) for real-time alerts.'],
 'references': [{'source': 'Cisco Security Advisory'}],
 'response': {'communication_strategy': ['Public security advisory',
                                         'Direct customer notifications via '
                                         'TAC'],
              'containment_measures': ['Immediate software upgrade to patched '
                                       'versions (e.g., 2.3.7.10-VA)'],
              'incident_response_plan_activated': True,
              'remediation_measures': ['No workarounds; mandatory patching']},
 'stakeholder_advisories': ['Cisco PSIRT advisory with fixed software details'],
 'title': 'Cisco Catalyst Center Virtual Appliance Privilege Escalation '
          'Vulnerability (CVE-2025-20341)',
 'type': ['Vulnerability', 'Privilege Escalation'],
 'vulnerability_exploited': 'CVE-2025-20341 (Insufficient Input Validation)'}