Cisco Catalyst Center Vulnerability Allows Attackers to Escalate Privileges

A critical security vulnerability has been identified in the Cisco Catalyst Center Virtual Appliance that could enable authenticated, remote attackers to escalate their privileges to Administrator on affected systems. This vulnerability CVE-2025-20341 is caused by insufficient validation of user-supplied input, and affects Catalyst Center Virtual Appliances deployed on VMware ESXi, with AWS deployments confirmed not to be vulnerable.

According to Cisco’s official advisory, the flaw allows an attacker with legitimate credentials, specifically any user account holding at least the Observer role, to submit crafted HTTP requests and gain control over the appliance’s administrative functions. The issue does not require initial Administrator privileges, as a valid Observer-level account provides a foothold for privilege escalation, expanding the attack surface significantly.

Notably, versions earlier than 2.3.7.3-VA and version 3.1 are not affected, while releases 2.3.7.3-VA and later require upgrading to at least 2.3.7.10-VA; there are no workarounds, and remediation requires upgrading to the fixed software release. At the time of the advisory’s release, Cisco’s PSIRT had not detected evidence of exploitation or public announcements.