Cisco DNA Center Command Runner Command Injection Vulnerability

Vulnerability

The vulnerability exists in the Command Runner tool of Cisco DNA Center. It stems from insufficient input validation, allowing an authenticated remote attacker to inject arbitrary commands. The attacker can provide crafted input during command execution or via a crafted Command Runner API call. Affected versions are those prior to the fixed releases detailed in the Cisco Security Advisory [1].

Exploitation

An attacker must be authenticated to Cisco DNA Center. Exploitation involves sending specially crafted input to the Command Runner tool, either through the web interface or through API calls. No additional user interaction is required beyond authentication. The attacker can then execute arbitrary CLI commands on devices managed by Cisco DNA Center.

Impact

Successful exploitation enables the attacker to execute arbitrary CLI commands on managed devices. This can lead to full compromise of those devices, including information disclosure, unauthorized configuration changes, and potential denial of service. The attacker gains the privileges of the Command Runner tool, which typically has administrative access to managed devices.

Mitigation

Cisco has released free software updates that address this vulnerability, as noted in the Cisco Security Advisory [1]. Users should upgrade to the fixed versions specified in the advisory. No workarounds are available. Customers should consult the advisory for the exact version numbers and upgrade instructions.