Cisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability

Vulnerability

The vulnerability resides in the Software Image Management (SWIM) feature of Cisco DNA Center. Due to insufficient validation of user-supplied input, an authenticated, remote attacker can send arbitrary HTTP requests to internal services. Cisco DNA Center versions prior to 1.2.5 are affected [1].

Exploitation

An attacker must have valid authentication credentials to the Cisco DNA Center web interface. By crafting malicious HTTP requests to the SWIM import interface, the attacker can force the device to proxy those requests to internal services that would otherwise be protected by firewalls or network segmentation. No additional user interaction is required [1].

Impact

Successful exploitation allows the attacker to bypass firewall protections and access unauthorized internal services. This could lead to information disclosure, further lateral movement, or compromise of internal systems. The attacker operates with the privileges of the authenticated user but gains access to services that should be restricted [1].

Mitigation

Cisco has released fixed software in Cisco DNA Center version 1.2.5. No workarounds are available. Users should upgrade to the fixed version to remediate the vulnerability [1].