Cisco Catalyst Center REST API Command Injection Vulnerability
TL;DR 📌
- A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This vulnerability is due to insufficient validation of user-supplied input in REST API request parameters. An attacker could exploit this vulnerability by sending a crafted API request…
- Highest CVSS: 6.3 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20349.
What it is
CVE-2025-20349 is a command injection vulnerability in the REST API of Cisco Catalyst Center, affecting both virtual and hardware appliances regardless of device configuration.
The flaw stems from insufficient validation of user-supplied input in REST API request parameters. An authenticated, remote attacker can send a crafted API request that injects arbitrary commands, which then execute inside a restricted container as the root user.
Exploitation requires network access to the REST API and valid credentials for a user account with at least the Observer role — Cisco’s lowest privilege tier. There is no need for administrative access; a low-privilege authenticated session is sufficient to reach the vulnerable code path. This is a management-plane issue: the attacker interacts with the Catalyst Center API rather than the data plane traffic it manages.
Cisco states there are no workarounds. The only remediation is upgrading to a fixed release.
What to do
- Upgrade Cisco Catalyst Center releases 2.3.7 and earlier to 2.3.7.10, which contains the fix. Release 3.1 is not affected.
- Since there is no workaround, treat the upgrade as the only path to remediation — do not rely on network segmentation or ACLs alone as a substitute.
- Review accounts holding Observer role or above on Catalyst Center; because the bar for exploitation is low-privilege authenticated access, tighten account provisioning and audit who holds these credentials until the upgrade is complete.
- Confirm REST API access to Catalyst Center is restricted to trusted management networks, reducing the pool of accounts and hosts that could reach the vulnerable endpoint while patching is scheduled.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 2.3.7.10 | 3.1 |
For leadership 🧭
Executive summary. Any Catalyst Center deployment running 2.3.7 or earlier lets a low-privilege, authenticated user escalate to root command execution via the REST API, and there is no workaround. Given Catalyst Center’s role managing network infrastructure, this should be scheduled for upgrade to 2.3.7.10 as soon as a change window allows.
Why it matters:
- The vulnerable code path is reachable by anyone holding Observer role, Cisco’s lowest privilege tier, so the attack surface includes every read-only account provisioned on the platform.
- Successful exploitation runs commands as root inside a restricted container, giving an attacker far more control than their assigned role should permit.
- Catalyst Center manages network device configuration, so compromising its management plane has knock-on implications for everything it administers.
- Cisco has published no workaround, meaning segmentation or ACLs can reduce exposure but cannot substitute for patching.
Now / Next / Later:
- Now: Identify every Catalyst Center instance running release 2.3.7 or earlier and list all accounts holding Observer role or above.
- Next: Upgrade affected Catalyst Center appliances to fixed release 2.3.7.10 in the next available change window; release 3.1 is already unaffected.
- Later: Tighten provisioning and periodic review of Observer-level accounts, and restrict REST API access to trusted management networks to reduce the pool of credentials and hosts that can reach the API.