Cisco DNA Center Information Disclosure Vulnerability

Vulnerability

An information disclosure vulnerability exists in the API endpoints of Cisco DNA Center, versions 2.2.2 and earlier, and 2.2.3. The vulnerability is due to improper access controls on specific API endpoints [1]. An attacker must have valid device credentials but can enumerate user information that should be restricted. Affected releases are Cisco DNA Center 2.2.2 and earlier, and 2.2.3 [1].

Exploitation

An authenticated, remote attacker with valid device credentials can exploit this vulnerability by sending a crafted API request to an affected Cisco DNA Center application [1]. No additional user interaction is required beyond the initial authentication. The attacker leverages the improper access controls to bypass intended authorization checks.

Impact

Successful exploitation allows the attacker to gain sensitive information about other users who are configured with higher privileges on the application [1]. This could include usernames, roles, or other attributes that facilitate further targeted attacks or privilege escalation within the Cisco DNA Center environment.

Mitigation

Cisco has released fixed versions: Cisco DNA Center 2.2.2.5 (for the 2.2.2 train) and 2.2.3.3 (for the 2.2.3 train) [1]. Customers should upgrade to the appropriate fixed release. No workarounds are documented in the advisory [1]. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.