Product:
Cisco Catalyst Center Virtual Appliance
Summary
A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.7 | CVE-2025-20355 |
Exploitation
To exploit this vulnerability, an attacker must intercept and modify an HTTP request sent by a user to the web-based management interface. By doing so, the attacker can manipulate the request parameters, leading to a redirection of the user to a malicious web page. This requires the attacker to have the ability to intercept network traffic and modify it before it reaches the target.
Affected Products
- Cisco Catalyst Center Virtual Appliance: Vulnerable due to improper input validation in the web-based management interface, allowing for potential redirection to malicious sites.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization for HTTP request parameters. Additionally, users should be educated on the risks of clicking on untrusted links and should ensure that their network traffic is secure.