CVE-2021-1577
Critical
Description
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Cisco Application Policy Infrastructure Controller
PublishedAug 25, 2021
First seenAug 25, 2021
Weakness typeCWE-284Improper access control
How to fix
Update
- cisco application_policy_infrastructure_controller3.2\(10e\), 4.2\(6h\), 5.1\(3e\) or later
- cisco cloud_application_policy_infrastructure_controller3.2\(10e\), 4.2\(6h\), 5.1\(3e\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco application_policy_infrastructure_controller | v < 3.2\(10e\), 4.0 ≤ v < 4.2\(6h\), 5.0 ≤ v < 5.1\(3e\) | 3.2\(10e\), 4.2\(6h\), 5.1\(3e\) |
| cisco cloud_application_policy_infrastructure_controller | v < 3.2\(10e\), 4.0 ≤ v < 4.2\(6h\), 5.0 ≤ v < 5.1\(3e\) | 3.2\(10e\), 4.2\(6h\), 5.1\(3e\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.