Cisco Catalyst Center Insufficient Access Control Vulnerability
TL;DR 📌
- A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an affected device. This vulnerability is due to insufficient enforcement of access control on HTTP requests. An attacker could exploit this vulnerability by submitting…
- Highest CVSS: 4.7 (Medium).
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2025-20223.
What it is
CVE-2025-20223 is an insufficient access control flaw in Cisco Catalyst Center (formerly Cisco DNA Center). It affects deployments that have Disaster Recovery enabled — this feature is not on by default, so an unconfigured or unregistered Disaster Recovery setup is not exposed.
The issue stems from HTTP requests not being properly access-controlled on an internal service. An authenticated, remote attacker can send a crafted HTTP request to reach a repository belonging to that internal service and both read and modify data held there.
Exploitation requires authentication (PR:H in the CVSS vector), meaning the attacker needs high privileges already on the system before they can abuse the flaw. There is no separate management-versus-data-plane distinction given beyond this being an internal service repository reachable over HTTP; the advisory does not describe the flaw as reachable without valid credentials.
Cisco’s PSIRT states this was found through internal testing, with no public announcements or known malicious use reported at the time of publication.
What to do
- Check whether Disaster Recovery is enabled: in the Catalyst Center GUI, go to System > Disaster Recovery. If the option is absent, or if it shows Unconfigured with all sites Unregistered, the deployment is not affected. Any other status means it is.
- If Disaster Recovery is configured, upgrade to Cisco Catalyst Center 2.3.7.7 or later, which is the first fixed release. Releases earlier than 2.3.7.7 are listed as affected.
- There are no workarounds — the only remediation path is upgrading to the fixed release.
- Since this requires authenticated access, review who holds credentials capable of reaching the affected internal service, particularly on systems where Disaster Recovery is in active use.
For leadership 🧭
Executive summary. Catalyst Center deployments running Disaster Recovery have a gap that lets a logged-in user tamper with data in an internal service they should not be able to touch. It needs fixing in the next maintenance window rather than urgently overnight, since no workaround exists and there is no sign of active abuse.
Why it matters:
- Only affects Catalyst Center instances where Disaster Recovery is enabled and configured (not the default state), so exposure is limited to a specific subset of deployments.
- An authenticated attacker can send a crafted HTTP request to reach an internal service’s repository and both read and modify its data, going beyond their intended permissions.
- There is no workaround Cisco can offer; the sole remediation is upgrading to Catalyst Center 2.3.7.7, meaning affected systems remain exposed until that upgrade is applied.
- Because exploitation requires existing high-privilege credentials, the practical risk is tied to how tightly access to the Catalyst Center management interface is currently controlled.
Now / Next / Later:
- Now: In the Catalyst Center GUI, go to System > Disaster Recovery and check the status — if it shows anything other than absent or Unconfigured with all sites Unregistered, the deployment is affected.
- Next: Schedule an upgrade to Cisco Catalyst Center 2.3.7.7 or later for any deployment where Disaster Recovery is configured, since no workaround is available.
- Later: Review and tighten the list of accounts holding credentials to Catalyst Center, particularly those with access to Disaster Recovery-enabled instances, to reduce the pool of users who could exploit this class of internal-service flaw.