Cisco Spaces Connector Privilege Escalation Vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters. A successful exploit could allow the attacker to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco DNA Spaces Connector | Connector 3 Jan 2023; Connector 3-May 2023; Connector 3-Jan 2024; Connector 3-Jun 2024; Connector 3-May 2024; Connector 3-Jul 2024; Connector 3-Jan 2025 | — | No fix listed | CNA |
- Cisco DNA Spaces Connector VendorCisco Affected Connector 3 Jan 2023; Connector 3-May 2023; Connector 3-Jan 2024; Connector 3-Jun 2024; Connector 3-May 2024; Connector 3-Jul 2024; Connector 3-Jan 2025 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:spaces_connector:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:jan_2023:*:*:*:*:*:* | 3.0 jan_2023 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:jan_2024:*:*:*:*:*:* | 3.0 jan_2024 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:jan_2025:*:*:*:*:*:* | 3.0 jan_2025 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:july_2024:*:*:*:*:*:* | 3.0 july_2024 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:may_2023:*:*:*:*:*:* | 3.0 may_2023 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:may_2024:*:*:*:*:*:* | 3.0 may_2024 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:spaces_connector:3.0:sep_2022:*:*:*:*:*:* | 3.0 sep_2022 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:spaces_connector:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:jan_2023:*:*:*:*:*:* Versions 3.0 jan_2023 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:jan_2024:*:*:*:*:*:* Versions 3.0 jan_2024 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:jan_2025:*:*:*:*:*:* Versions 3.0 jan_2025 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:july_2024:*:*:*:*:*:* Versions 3.0 july_2024 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:may_2023:*:*:*:*:*:* Versions 3.0 may_2023 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:may_2024:*:*:*:*:*:* Versions 3.0 may_2024 Vulnerable ·Cisco
- cpe:2.3:a:cisco:spaces_connector:3.0:sep_2022:*:*:*:*:*:* Versions 3.0 sep_2022 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20308
- 2026-10-03 Alias added: GHSA-4px3-h2gc-v24p
References
Advisory 1
Sources
- CVE-2025-20308 · CVE Program
- CVE-2025-20308 · NVD
- FIRST EPSS
- GHSA-4px3-h2gc-v24p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences