Cisco Catalyst Center CVE-2025-20349

Exploitation requires authenticated access to the Cisco Catalyst Center REST API with a user account holding at least the Observer role (CVSS PR:L); the flaw lies in insufficient validation of user-supplied input in REST API request parameters, and successful injection runs commands as root but WITHIN a restricted container (not directly on the host), which limits immediate blast radius. The primary limiting factor is the credential requirement - a pre-existing valid account is mandatory, so this is not exploitable by fully unauthenticated attackers - but because Observer is a low/read-only privilege level, the credential bar is relatively low for any insider or attacker who has harvested operator credentials. No special non-default configuration is called out by the vendor; the REST API is a core management interface.

This is a genuine but conditional priority, not an unauthenticated internet-facing emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and Cisco's own text agree that exploitation is remote, low-complexity, requires no user interaction, but DOES require valid credentials - specifically a user account with at least the Observer role, so PR:L is well-supported and consistent across all signals (no network-vs-local conflict here). The 8.8 score is driven by full C/I/H impact (root command execution inside a restricted container). Countervailing signals keep this below the 'drop everything' tier: EPSS is low at 0.35% (58th percentile), there is no CISA KEV listing, and no public exploit code has been identified - so there is no evidence of active or imminent mass exploitation at time of analysis. The realistic concern is that Observer is Cisco Catalyst Center's lowest/read-only role, so an attacker who phishes or reuses any low-privilege operator credential can escalate to root command execution on a network-management platform that controls large fleets of network devices - a high-value post-authentication target. Net: treat as a high-priority patch for a sensitive management appliance, but the authentication requirement and absent exploitation evidence mean it is a prioritized-patch item rather than a confirmed in-the-wild crisis.

An attacker who has obtained credentials for even a low-privilege Observer-role account (via phishing, credential reuse, or a leaked service account) sends a crafted REST API request with malicious input in a request parameter. Insufficient validation lets injected OS commands execute as root inside a restricted container on the Catalyst Center appliance. No public proof-of-concept has been identified, and no user interaction beyond the attacker's own authenticated request is required.