CVE-2021-1577: critical vulnerability in Cisco Application Policy Infrastructure…
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 1.3%
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Cisco · Cisco Application Policy Infrastructure Controller (APIC)Related CVEs — Cisco Application Policy Infrastructure…
In the same product, most dangerous first.
CVE-2019-1889HIGHCisco Application Policy Infrastructure Controller REST API Privilege Escalation VulnerabilityEPSS 2.8%CVE-2021-1579HIGHCisco Application Policy Infrastructure Controller App Privilege Escalation VulnerabilityEPSS 2.1%CVE-2021-1578HIGHCisco Application Policy Infrastructure Controller Privilege Escalation VulnerabilityEPSS 2.0%CVE-2021-1580MEDIUMCisco Application Policy Infrastructure Controller Command Injection and File Upload VulnerabilitiesEPSS 1.8%CVE-2019-1692MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Usage Information Disclosure VulnerabilityEPSS 1.2%CVE-2019-1587MEDIUMCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Filter Query Information Disclosure VulnerabilityEPSS 1.2%