Cisco Spaces Connector Privilege Escalation Vulnerability

TL;DR 📌

• A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20308.

What happened 🕵️‍♂️

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.

This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters. A successful exploit could allow the attacker to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected products 🖥️

At the time of publication, this vulnerability affected Cisco Spaces Connector, regardless of device configuration.

For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-spaces-conn-privesc-kgD2CcDU
• Initial release: 2025-07-02T16:00:00 UTC
• Last updated: 2025-07-02T16:00:00 UTC

For leadership 🧭

Executive summary. Anyone holding the spacesadmin account on a Cisco Spaces Connector can escalate to root and take full control of the appliance’s operating system. There is currently no workaround and no fixed release listed, so exposure depends entirely on how tightly spacesadmin access is controlled today.

Why it matters:

• The path to root goes through the spacesadmin CLI account, which is the standard administrative login for Cisco Spaces Connector — anyone with that credential can trigger the escalation.
• Success gives an attacker arbitrary command execution as root on the underlying OS, not just within the Spaces application, meaning full device compromise.
• No workaround is available and no fixed software has yet been published, so the only current lever is controlling who can reach the spacesadmin CLI.
• Every deployment of Cisco Spaces Connector is affected regardless of how it is configured, so this cannot be configured away.

Now / Next / Later:

• Now: Identify every Cisco Spaces Connector deployment, list who holds spacesadmin credentials, and tighten or revoke access for anyone who doesn’t need CLI login rights.
• Next: Watch the advisory for the first fixed release and schedule an upgrade as soon as one is published; in the meantime restrict CLI access to jump hosts or bastion accounts with logging enabled.
• Later: Adopt least-privilege and credential-rotation practices for all appliance CLI accounts like spacesadmin, and build a process to fast-track patching for Spaces Connector once fixes ship.