CVE-2025-20349: Cisco Catalyst Center RCE Vulnerability

CVE-2025-20349 Overview

Cisco disclosed CVE-2025-20349, a command injection vulnerability in the REST API of Cisco Catalyst Center. The flaw allows an authenticated, remote attacker to execute arbitrary commands inside a restricted container as the root user. Exploitation requires valid credentials for an account holding at least the Observer role, which is the lowest privilege tier in Catalyst Center.

The weakness is tracked as CWE-78, OS Command Injection, and stems from insufficient validation of user-supplied input in REST API request parameters. Cisco rates the issue 8.8 on the CVSS v3.1 scale.

Critical Impact
A low-privileged Observer account can be abused to inject operating system commands that run as root inside a restricted Catalyst Center container, exposing network management infrastructure to full compromise.

Affected Products

Cisco Catalyst Center (formerly Cisco DNA Center)
Catalyst Center REST API endpoints accepting user-supplied parameters
Deployments where Observer or higher roles are assigned to non-administrative users

Discovery Timeline

2025-11-13 - CVE-2025-20349 published to the National Vulnerability Database
2025-11-13 - Cisco publishes security advisory cisco-sa-dnac-ci-ZWLQVSwT
2025-11-19 - Last updated in NVD database

Technical Details for CVE-2025-20349

Vulnerability Analysis

The vulnerability resides in the REST API layer of Cisco Catalyst Center. API request parameters are passed to backend logic without sufficient validation or sanitization. An attacker who can authenticate to the API can supply crafted values that the underlying handler interprets as shell metacharacters or additional command tokens.

Because the affected backend logic executes in a container that runs commands as the root user, any injected command inherits root-level privileges within that container. The container is described by Cisco as restricted, but root execution materially expands the attacker's options for tampering with managed network state, reading sensitive configuration, and pivoting within the appliance.

The attack requires authentication, but the minimum role needed is Observer. Observer is intended as a read-only role, so any organization that issues Observer accounts broadly should treat those credentials as capable of full command execution on the appliance.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The REST API accepts parameters that are concatenated or otherwise passed into a system command path without escaping shell metacharacters such as ;, |, `, and $(). Cisco's advisory describes this as insufficient validation of user-supplied input in REST API request parameters.

Attack Vector

The attack vector is network-based. The attacker sends a crafted HTTPS request to a vulnerable REST API endpoint on the Catalyst Center management interface. Authentication uses any valid Catalyst Center account at Observer level or higher. No user interaction is required, and the attacker does not need physical or adjacent network access.

A successful request causes the backend handler to execute the injected command inside the affected container with root privileges. Refer to the Cisco Security Advisory for endpoint specifics and fixed release details.

Detection Methods for CVE-2025-20349

Indicators of Compromise

REST API requests from Observer-role accounts containing shell metacharacters such as ;, &&, |, `, or $() in parameter values
Unexpected child processes spawned by Catalyst Center container services, particularly shells (/bin/sh, /bin/bash) or network utilities (curl, wget, nc)
Outbound network connections originating from Catalyst Center containers to untrusted destinations
New or modified files in writable container paths shortly after API activity from low-privilege accounts

Detection Strategies

Enable and forward Catalyst Center audit logs and API access logs to a central SIEM for correlation with process and network telemetry
Alert on Observer-role accounts performing API calls that modify state or trigger backend processing beyond read operations
Baseline normal API parameter content and flag requests containing shell metacharacters or encoded variants
Monitor container runtime telemetry for unexpected process trees rooted in Catalyst Center service binaries

Monitoring Recommendations

Review all accounts with Observer role or higher and confirm they belong to active administrators
Track authentication events to Catalyst Center, particularly successful logins from new source IP addresses
Capture and retain full REST API request bodies for forensic review during the exposure window
Correlate Catalyst Center activity with changes to managed network device configurations

How to Mitigate CVE-2025-20349

Immediate Actions Required

Apply the fixed Catalyst Center release identified in Cisco advisory cisco-sa-dnac-ci-ZWLQVSwT as soon as practical
Audit all Catalyst Center user accounts and remove unused or shared Observer-level credentials
Restrict network reachability of the Catalyst Center management interface to trusted administrative networks
Rotate credentials for any account that authenticated to Catalyst Center from unexpected sources during the exposure window

Patch Information

Cisco has published fixed software releases and remediation guidance in the Cisco Security Advisory cisco-sa-dnac-ci-ZWLQVSwT. Customers should consult the advisory for the specific fixed Catalyst Center versions applicable to their deployment and follow Cisco's upgrade procedure. No official workaround that fully removes the vulnerability is available.

Workarounds

Enforce least-privilege role assignment so the Observer role is granted only to users who require it
Place the Catalyst Center management plane behind a jump host or VPN with strict access control lists
Enable multi-factor authentication for all Catalyst Center accounts to raise the cost of credential abuse
Monitor REST API traffic with a web application firewall capable of inspecting parameter content for command injection patterns