CVE-2023-20182: cisco catalyst_center Improper Authorization
Vulnerability summary
CVE-2023-20182 is a high (CVSS 8.8) Improper Authorization vulnerability in cisco catalyst_center. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.
Timeline
- 18-05-2023PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Cisco2 products
- catalyst_center< 2.3.3.7 | ≥ 2.3.4, < 2.3.5.3
- cisco digital network architecture center (dna center)n/a
1 vendor · 2 products