A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper role-based access control (RBAC) with the integration of PnP. An attacker could exploit this vulnerability by authenticating to the device and sending a query to an internal API. A successful exploit could allow the attacker to view sensitive information in clear text, which could include configuration files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCisco Catalyst Center
APPCisco< 2.3.3.72.3.4.0 β 2.3.5.0 (bez)
Related vulnerabilities
A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker t...
A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unau...
A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthen...
A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to ele...
A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Softwa...