CVE-2025-20346: Cisco Catalyst Center Privilege Escalation

CVE-2025-20346 Overview

Cisco Catalyst Center contains an improper role-based access control (RBAC) flaw that allows an authenticated remote attacker to perform Administrator-level policy operations using only Observer (read-only) credentials. The vulnerability affects the enforcement layer that validates user role permissions on policy configuration endpoints. A low-privileged user can modify policy configurations that should be reserved for Administrator accounts, undermining the segregation of duties model that enterprise network management platforms rely on. Cisco published the advisory on November 13, 2025 and tracks the issue under [CWE-269: Improper Privilege Management].

Critical Impact
An authenticated user with the Observer role can modify Administrator-restricted policy configurations, breaking RBAC boundaries in Cisco Catalyst Center deployments used to manage enterprise network infrastructure.

Affected Products

Cisco Catalyst Center (formerly DNA Center)
Deployments exposing the web management interface to authenticated users
Environments using Observer or other low-privilege roles for read-only monitoring

Discovery Timeline

2025-11-13 - CVE-2025-20346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20346

Vulnerability Analysis

The vulnerability is a vertical privilege escalation flaw in Cisco Catalyst Center's RBAC implementation. Catalyst Center enforces user permissions through role assignments such as Observer, Network Administrator, and Super Admin. The Observer role is intended to provide read-only visibility into policy and configuration data. This flaw allows an Observer to invoke policy-modification operations that the RBAC layer should reject.

The attacker path requires valid credentials for any account with at least the Observer role. Because Observer accounts are frequently provisioned for auditors, contractors, and monitoring integrations, the credential prerequisite is often low friction in real environments. Once authenticated, the attacker interacts with the affected policy configuration APIs to persist changes normally reserved for Administrators.

Successful exploitation compromises integrity of network policy state without affecting confidentiality or availability. Downstream impact depends on the specific policies an attacker can alter, which may influence segmentation, access control, or service assurance configurations pushed to managed devices.

Root Cause

The root cause is missing or incorrect authorization checks on specific policy configuration endpoints. The application authenticates the session correctly but does not consistently verify that the acting user holds an Administrator-equivalent role before applying policy changes. This is a classic [CWE-269] Improper Privilege Management defect where enforcement diverges from the documented role model.

Attack Vector

The attack is remote and network-based over the Catalyst Center management interface. The attacker logs in with valid Observer credentials, then issues policy modification requests to the affected API paths. No user interaction is required, and no additional exploitation primitives such as memory corruption or injection are needed. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Cisco Security Advisory for the affected release matrix and fixed versions.

Detection Methods for CVE-2025-20346

Indicators of Compromise

Policy configuration changes in Catalyst Center audit logs attributed to users holding only the Observer role.
Unexpected modifications to network policies, group-based access policies, or fabric configurations that do not correspond to a change ticket.
API calls to policy modification endpoints originating from sessions authenticated as read-only users.

Detection Strategies

Review Catalyst Center audit and activity logs for write operations performed by accounts assigned the Observer role or any non-Administrator role.
Correlate authentication events with subsequent policy change events to identify role-inconsistent behavior.
Baseline the set of user accounts that legitimately modify policy configurations and alert on deviations.

Monitoring Recommendations

Forward Catalyst Center audit logs to a centralized SIEM or data lake and build detections keyed on the combination of user role and API action.
Alert on any HTTP write method (POST, PUT, PATCH, DELETE) to policy configuration paths from sessions tied to non-Administrator principals.
Track configuration drift on managed network devices and reconcile changes against approved change windows.

How to Mitigate CVE-2025-20346

Immediate Actions Required

Apply the fixed Cisco Catalyst Center release identified in the Cisco Security Advisory cisco-sa-privesc-catc-rYjReeLU.
Inventory all Catalyst Center user accounts and remove or disable Observer accounts that are no longer required.
Rotate credentials for shared or service accounts that hold the Observer role, especially those used by external contractors or integrations.
Review recent audit logs for policy changes made by non-Administrator users and roll back unauthorized modifications.

Patch Information

Cisco has released fixed software for Catalyst Center. Consult the vendor advisory for the exact fixed release train applicable to your deployment. No workaround is listed by Cisco, so upgrading to a fixed release is the required remediation. Reference: Cisco Security Advisory.

Workarounds

Restrict management-plane network access to Catalyst Center so that only administrative jump hosts can reach the web interface.
Enforce multi-factor authentication on all Catalyst Center accounts, including read-only roles, to raise the cost of credential compromise.
Audit RBAC assignments and eliminate unnecessary Observer accounts pending patch deployment.

bash

# Example: list active Catalyst Center users and roles via the platform API
# Replace <catc-host> and use a valid admin token
curl -sk -H "X-Auth-Token: $CATC_TOKEN" \
  "https://<catc-host>/dna/system/api/v1/user" \
  | jq '.response[] | {username: .username, roleList: .roleList}'