Cisco Catalyst Center Virtual Appliance HTTP Open Redirect Vulnerability
TL;DR 📌
- A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a…
- Highest CVSS: 4.7 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20355.
What it is
CVE-2025-20355 is an open redirect flaw in the web-based management interface of Cisco Catalyst Center Virtual Appliance. It stems from improper input validation of HTTP request parameters.
Exploitation requires an attacker to intercept and modify an HTTP request from a user of the management interface — this is not a purely unauthenticated remote injection, but the CVSS vector confirms no privileges are required on the attacker’s part and user interaction is needed (a victim following a manipulated link or request). The outcome is limited to redirecting the target user to a malicious web page; there is no confidentiality or availability impact and only a minor integrity impact, consistent with the 4.7 (Medium) score.
The affected component is specifically the Virtual Appliance running on VMware ESXi. Cisco has confirmed that Catalyst Center hardware appliances and the Virtual Appliance on AWS are not affected, regardless of configuration.
Cisco states it is not aware of any public announcements or malicious use of this vulnerability, and it is not listed in CISA’s Known Exploited Vulnerabilities catalogue.
What to do
- Identify any Catalyst Center Virtual Appliance instances running on VMware ESXi; these are the only affected deployments (AWS-hosted VAs and hardware appliances are confirmed not vulnerable).
- Releases 2.3.7.3-VA and later, up to but not including 3.1, are vulnerable. Upgrade to 2.3.7.10-VA or to 3.1, both of which are fixed. Releases earlier than 2.3.7.3-VA are not vulnerable.
- There is no workaround — remediation requires the software upgrade.
- Since exploitation relies on intercepting and modifying an HTTP request from a legitimate user, ensure administrative access to the Catalyst Center web interface is confined to trusted networks and transported over TLS, to reduce opportunities for request tampering pending the upgrade.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 2.3.7.10-VA | 3.1 |
For leadership 🧭
Executive summary. A medium-severity flaw in Catalyst Center’s web management interface can send an administrator’s browser to a malicious site if their HTTP request is intercepted and altered in transit. It only affects the VMware ESXi virtual appliance, has no workaround, and should be scheduled for the upgrade path rather than treated as an emergency.
Why it matters:
- Only the Catalyst Center Virtual Appliance on VMware ESXi is affected; hardware appliances and the AWS-hosted virtual appliance are confirmed not vulnerable, which narrows the fleet that needs checking.
- Exploitation depends on an attacker being able to intercept and modify an HTTP request from someone using the Catalyst Center management interface, so it points directly at how admin traffic reaches that interface today.
- There is no workaround, so the only remediation is upgrading affected releases (2.3.7.3-VA and later, before 3.1) to the fixed 2.3.7.10-VA or 3.1 release.
- Impact is limited to redirecting a user’s browser to a malicious page — there is no data exposure or service disruption from this flaw on its own, which is why it scores 4.7 rather than higher.
Now / Next / Later:
- Now: Confirm which Catalyst Center Virtual Appliance instances run on VMware ESXi and check their release version against the 2.3.7.3-VA to pre-3.1 vulnerable range.
- Next: Schedule an upgrade of affected ESXi-hosted virtual appliances to 2.3.7.10-VA or 3.1 in the next available maintenance window, since no workaround exists.
- Later: Restrict access to the Catalyst Center web management interface to trusted, TLS-protected network paths to reduce the chance of admin HTTP requests being intercepted or tampered with in future.