CVE-2016-1302

High

Published: 07/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Cisco Application Policy Infrastructure Controller (APIC) devices and Nexus 9000 ACI Mode switches with specific software versions allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests.

Risk Assessment

Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to update the software to version 1.0(3h) or 1.1(1j) for APIC and 11.0(3h) or 11.1(1j) for Nexus 9000 switches to mitigate this vulnerability.

Other vulnerabilities in Cisco Application Policy Infrastructure Controller (APIC), Nexus 9000 ACI Mode switches

CVE-2015-4235High
Cisco Application Policy Infrastructure Controller (APIC) and Nexus 9000 ACI devices with software before version 1.0(3o) and 11.0(4o) do not properly restrict access to the APIC filesystem, allowing remote authenticated users to obtain root privileges.

Original NVD description (English source)

Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.