CVE-2021-1303: cisco catalyst_center Incorrect Privilege Assignment

Vulnerability summary

CVE-2021-1303 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in cisco catalyst_center. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities.

Timeline

1. 20-01-2021
   PublishedVulnerability first disclosed.
2. 12-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by authenticating as a user with an Observer role and executing commands on the affected device. A successful exploit could allow a user with the Observer role to execute commands to view diagnostic information of the devices that Cisco DNA Center manages.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.