Cisco DNA Center Information Disclosure Vulnerability

Vulnerability

A vulnerability in the configuration archive functionality of Cisco DNA Center allows any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The issue stems from configuration archive files being stored in clear text, which can be retrieved via API calls. This affects Cisco DNA Center deployments where the configuration archive feature is enabled. The specific affected versions are detailed in the Cisco Security Advisory [1].

Exploitation

An attacker must have valid credentials to authenticate to Cisco DNA Center at any privilege level. No additional user interaction is required. The attacker then executes a series of API calls to retrieve the stored configuration archive files, which are in clear text. The exact API endpoints are not publicly detailed but are accessible to authenticated users.

Impact

Successful exploitation allows the attacker to retrieve the full unmasked running configurations of managed devices. This results in significant information disclosure, exposing sensitive network device settings, credentials, and other configuration details that could be used for further attacks.

Mitigation

Cisco has released software updates to fix this vulnerability. Customers should upgrade to the fixed versions specified in the Cisco Security Advisory [1]. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.