CVE-2021-1303
High
Description
A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by authenticating as a user with an Observer role and executing commands on the affected device. A successful exploit could allow a user with the Observer role to execute commands to view diagnostic information of the devices that Cisco DNA Center manages.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Cisco Catalyst Center
PublishedJan 20, 2021
First seenJan 20, 2021
Weakness typeCWE-266CWE-266
How to fix
Update
- cisco catalyst_center2.1.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco catalyst_center | v < 2.1.2.0 | 2.1.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.