cbcvebase.
CVE-2021-1577
published 2021-08-25

CVE-2021-1577: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller…

PriorityP267critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.30%
67.5th percentile
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.

Affected

8 ranges
VendorProductVersion rangeFixed in
ciscoapplication_policy_infrastructure_controller< 3.2\(10e\)3.2\(10e\)
ciscoapplication_policy_infrastructure_controller
ciscoapplication_policy_infrastructure_controller>= 4.0 < 4.2\(6h\)4.2\(6h\)
ciscoapplication_policy_infrastructure_controller>= 5.0 < 5.1\(3e\)5.1\(3e\)
ciscocisco_application_policy_infrastructure_controller
ciscocloud_application_policy_infrastructure_controller< 3.2\(10e\)3.2\(10e\)
ciscocloud_application_policy_infrastructure_controller>= 4.0 < 4.2\(6h\)4.2\(6h\)
ciscocloud_application_policy_infrastructure_controller>= 5.0 < 5.1\(3e\)5.1\(3e\)

Detection & IOCsextracted from sources · hover to see the quote

  • Exploit targets a specific unauthenticated API endpoint on Cisco APIC/Cloud APIC to upload or read arbitrary files — monitor for unexpected or unauthenticated file upload/read requests to APIC API endpoints
  • No authentication is required to exploit this vulnerability — alert on unauthenticated API calls to Cisco APIC REST API endpoints, especially those involving file operations
  • Track Cisco Bug ID CSCvw57556 for vendor patch and internal detection correlation
  • ·Both on-premises Cisco APIC and cloud-hosted Cloud APIC are affected by this vulnerability

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_cisco9.1CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.