Cisco DNA Center Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco DNA Center software, releases earlier than 2.2.1.0 [1]. The vulnerability arises because the interface does not properly validate user-supplied input. An attacker with administrative privileges can inject malicious script code into a page that is later viewed by another interface user.

Exploitation

An attacker must first obtain valid administrative credentials for the affected Cisco DNA Center device. With those credentials, the attacker can craft a malicious link containing XSS payload. The exploit requires social engineering to persuade a victim user (who is also authenticated to the interface) to click the crafted link [1]. No additional privileges or network position beyond administrative access are needed.

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the victim's browser session on the Cisco DNA Center management interface. This could lead to disclosure of sensitive browser-based information, such as session tokens or cookies, and potentially further compromise of the management interface [1]. The attack is confined to the browser session; system-level compromise is not directly achieved.

Mitigation

Cisco released a fix in Cisco DNA Center Release 2.2.1.0. Users should upgrade to this version or later [1]. No workarounds are available [1]. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.