CVE-2015-6333
published 2015-10-16CVE-2015-6333: Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID…
PriorityP416medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.36%
29.0th percentile
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mwwc-9v58-7m9j: Cisco Application Policy Infrastructure Controller (APIC) 1
ghsa_unreviewed·2022-05-17
CVE-2015-6333 [MEDIUM] GHSA-mwwc-9v58-7m9j: Cisco Application Policy Infrastructure Controller (APIC) 1
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.
Cisco
Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
vendor_cisco·2015-10-13·CVSS 4.3
CVE-2015-6333 [MEDIUM] CWE-264 Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
A vulnerability in SSH key handling for user accounts in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to elevate privileges.
The vulnerability is due to improper validation of SSH keys local users add their accounts. An attacker could exploit this vulnerability by authenticating to the device and adding an SSH key to the attacker's local account. An exploit could allow the attacker to elevate privileges on the local shell and perform unauthorized actions.
Software updates are not available.
Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/s
Cisco
Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
vendor_cisco
CVE-2015-6333 Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
CVE-2015-6333: Cisco Application Policy Infrastructure Controller Privilege Escalation SSH Key Vulnerability
A vulnerability in SSH key handling for user accounts in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to elevate privileges. The vulnerability is due to improper validation of SSH keys local users add their accounts. An attacker could exploit this vulnerability by authenticating to the device and adding an SSH key to the attacker's local account. An exploit could allow the attacker to elevate privileges on the local shell and perform unauthorized actions. Software updates are not available.
CWE: CWE-264, CWE-264
Bug IDs: CSCuw46076
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-10-16
Published