CVE-2021-1579: high-severity vulnerability in Cisco Application Policy Infrastructure…
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 2.1%
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system. This vulnerability is due to an insufficient role-based access control (RBAC). An attacker with Administrator read-only credentials could exploit this vulnerability by sending a specific API request using an app with admin write credentials. A successful exploit could allow the attacker to elevate privileges to Administrator with write privileges on the affected device.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
Cisco · Cisco Application Policy Infrastructure Controller (APIC)Related CVEs — Cisco Application Policy Infrastructure…
In the same product, most dangerous first.
CVE-2019-1889HIGHCisco Application Policy Infrastructure Controller REST API Privilege Escalation VulnerabilityEPSS 2.8%CVE-2021-1578HIGHCisco Application Policy Infrastructure Controller Privilege Escalation VulnerabilityEPSS 2.0%CVE-2021-1580MEDIUMCisco Application Policy Infrastructure Controller Command Injection and File Upload VulnerabilitiesEPSS 1.8%CVE-2021-1577CRITICALCisco Application Policy Infrastructure Controller Arbitrary File Read and Write VulnerabilityEPSS 1.3%CVE-2019-1692MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Usage Information Disclosure VulnerabilityEPSS 1.2%CVE-2019-1587MEDIUMCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Filter Query Information Disclosure VulnerabilityEPSS 1.2%