Cisco Catalyst Center Unprotected API Endpoint

Vulnerability

The vulnerability exists in the management API of Cisco Catalyst Center (formerly Cisco DNA Center). An API endpoint lacks authentication, allowing an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings [1]. Affected versions are those prior to the fixed release; the advisory indicates free software updates are available.

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to the affected API endpoint of a Catalyst Center device. No authentication is required, and the attacker does not need prior access to the network beyond network connectivity to the device.

Impact

Successful exploitation allows the attacker to view or modify the outgoing proxy configuration. This could disrupt internet traffic from Cisco Catalyst Center or allow the attacker to intercept outbound internet traffic, leading to potential information disclosure or traffic manipulation.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to the fixed version as indicated in the Cisco Security Advisory [1]. No workarounds are mentioned; customers with service contracts should obtain updates through their usual channels.