CVE-2021-1577
published 2021-08-25CVE-2021-1577: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller…
PriorityP267critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.30%
67.5th percentile
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | application_policy_infrastructure_controller | < 3.2\(10e\) | 3.2\(10e\) |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | >= 4.0 < 4.2\(6h\) | 4.2\(6h\) |
| cisco | application_policy_infrastructure_controller | >= 5.0 < 5.1\(3e\) | 5.1\(3e\) |
| cisco | cisco_application_policy_infrastructure_controller | — | — |
| cisco | cloud_application_policy_infrastructure_controller | < 3.2\(10e\) | 3.2\(10e\) |
| cisco | cloud_application_policy_infrastructure_controller | >= 4.0 < 4.2\(6h\) | 4.2\(6h\) |
| cisco | cloud_application_policy_infrastructure_controller | >= 5.0 < 5.1\(3e\) | 5.1\(3e\) |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit targets a specific unauthenticated API endpoint on Cisco APIC/Cloud APIC to upload or read arbitrary files — monitor for unexpected or unauthenticated file upload/read requests to APIC API endpoints ↗
- →No authentication is required to exploit this vulnerability — alert on unauthenticated API calls to Cisco APIC REST API endpoints, especially those involving file operations ↗
- →Track Cisco Bug ID CSCvw57556 for vendor patch and internal detection correlation ↗
- ·Both on-premises Cisco APIC and cloud-hosted Cloud APIC are affected by this vulnerability ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_cisco9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c569-4cq6-rvg9: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Cont
ghsa_unreviewed·2022-05-24
CVE-2021-1577 [CRITICAL] CWE-863 GHSA-c569-4cq6-rvg9: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Cont
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
Cisco
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
vendor_cisco·2021-08-25·CVSS 9.1
CVE-2021-1577 [CRITICAL] CWE-284 Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system.
This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available a
Cisco
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1577 Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
CVE-2021-1577: Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-284, CWE-284
Bug IDs: CSCvw57556
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-08-25
Published