CVSS: 7.5EPSS: 0%CPEs: 46EXPL: 0CVE-2024-20350 – Cisco Catalyst Center Static SSH Host Key Vulnerability
https://notcve.org/view.php?id=CVE-2024-20350
A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections, which could allow the attacker to intercept traffic between SSH clients and a Cisco Catalyst Center appliance. A successful exploit could allow the attacker to impersonate the affected appliance, inject commands into the terminal session, and steal valid user credentials. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ssh-e4uOdASj • CWE-321: Use of Hard-coded Cryptographic Key •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2024-20333
https://notcve.org/view.php?id=CVE-2024-20333
A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to change specific data within the interface on an affected device. This vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to change a specific field within the web-based management interface, even though they should not have access to change that field. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Catalyst Center, anteriormente Cisco DNA Center, podría permitir que un atacante remoto autenticado cambie datos específicos dentro de la interfaz de un dispositivo afectado. Esta vulnerabilidad se debe a una aplicación insuficiente de la autorización. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccc-authz-bypass-5EKchJRb • CWE-285: Improper Authorization •