CVE-2015-4235

High

Published: 24/07/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Cisco Application Policy Infrastructure Controller (APIC) and Nexus 9000 ACI devices with software before version 1.0(3o) and 11.0(4o) do not properly restrict access to the APIC filesystem, allowing remote authenticated users to obtain root privileges.

Risk Assessment

Improper access restriction may lead to privilege escalation, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update the software to the latest version to mitigate this vulnerability and implement additional security measures for filesystem access.

Other vulnerabilities in Cisco Application Policy Infrastructure Controller (APIC), Nexus 9000 ACI

CVE-2016-1302High
Cisco Application Policy Infrastructure Controller (APIC) devices and Nexus 9000 ACI Mode switches with specific software versions allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests.

Original NVD description (English source)

Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.