Cisco Catalyst Center REST API Command Injection Vulnerability

TL;DR 📌

A command injection vulnerability has been identified in the Cisco Catalyst Center REST API, allowing authenticated attackers to execute arbitrary commands with root privileges. The highest CVSS score for this vulnerability is 6.3 (Medium). No workarounds are available, but fixed software is provided.

What happened 🕵️‍♂️

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This issue arises from insufficient validation of user-supplied input in REST API request parameters. An attacker must have valid credentials for a user account with at least the role of Observer to exploit this vulnerability.

Affected products 🖥️

The vulnerability affects both virtual and hardware appliances of Cisco Catalyst Center, regardless of device configuration. Specifically, the following software releases are impacted:

• Cisco Catalyst Center Release 2.3.7 and earlier

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

With a CVSS score of 6.3, this vulnerability is rated as Medium risk. While it requires authentication, the potential for command execution with root privileges poses a significant threat if exploited. Organizations should prioritize upgrading to the fixed software to mitigate this risk.

Fast facts ⚡

• Vulnerability: Command injection in Cisco Catalyst Center REST API
• CVSS Score: 6.3 (Medium)
• Exploitation: Requires authenticated access
• Workarounds: None available
• Fixed Release: 2.3.7.10

For leadership 🧭

Executive summary. Cisco Catalyst Center, used to manage enterprise network infrastructure, has a REST API flaw that lets a logged-in user with minimal privileges run commands as root, with no workaround available. It’s rated Medium severity and not known to be under active exploitation, but any account with API access is effectively a path to full control of the appliance, so it should be patched at the next opportunity rather than left indefinitely.

Why it matters:

• The low bar for exploitation is the concern: an account with only the Observer role, normally used for read-only monitoring, is enough to trigger command execution as root.
• Catalyst Center manages network device configuration across an estate, so root access on the appliance could be leveraged to affect the wider network it controls.
• No workaround exists, so the only mitigation is upgrading or restricting who holds even Observer-level API credentials until the patch is applied.
• Both virtual and hardware appliances running 2.3.7 or earlier are affected regardless of configuration, so exposure isn’t limited to specific deployment choices.

Now / Next / Later:

• Now: Identify every Cisco Catalyst Center instance in your estate on release 2.3.7 or earlier, and review who currently holds Observer-level or higher accounts with REST API access.
• Next: Schedule an upgrade to Catalyst Center 2.3.7.10 (or the appropriate fixed release for later trains) during your next maintenance window, as no workaround is available.
• Later: Tighten issuance and review of API-capable accounts on network management platforms like Catalyst Center, treating even read-only roles as privileged given their API exposure.