What is CVE-2021-1303?

CVE-2021-1303 is a high-severity vulnerability in Cisco Catalyst Center, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2021-01-20.

How severe is CVE-2021-1303?

High severity. CVSS v3 base score is 8.8 out of 10.

Privilege escalation in Cisco Catalyst Center

CVE-2021-1303

A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by authenticating as a user with an Observer role and executing commands on the affected device. A successful exploit could allow a user with the Observer role to execute commands to view diagnostic information of the devices that Cisco DNA Center manages.

EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Catalyst_center
Cisco Digital Network Architecture Center (Dna Center) — versions n/a

Weakness classification (CWE)

CWE-266 — Incorrect Privilege Assignment

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2021-1303?: CVE-2021-1303 is a high-severity vulnerability in Cisco Catalyst Center, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2021-01-20.
How severe is CVE-2021-1303?: High severity. CVSS v3 base score is 8.8 out of 10.