Cisco DNA Center Privilege Escalation Vulnerability

Vulnerability

A vulnerability in the management API of Cisco DNA Center allows an authenticated, remote attacker to elevate privileges in the context of the web-based management interface. This flaw is due to the unintended exposure of sensitive information in API responses. Affected versions are those prior to the fixed release; Cisco recommends consulting the advisory for exact version details [1].

Exploitation

An attacker must have at least valid Observer credentials to authenticate to the management API. By inspecting responses from the API, the attacker can obtain sensitive information that enables privilege escalation [1]. No additional user interaction is required beyond authentication with Observer-level credentials.

Impact

Successful exploitation allows the attacker to access the API with the privileges of a higher-level user account, leading to unauthorized elevation of privileges within the management interface. This could result in broader control over the Cisco DNA Center device [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers with service contracts should obtain fixes through their usual update channels. The advisory provides details on fixed versions and workarounds [1]. If no fix can be applied, restrict API access to trusted users only.