CVE-2024-20478
published 2024-08-28CVE-2024-20478: A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly…
PriorityP351high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.74%
50.8th percentile
A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.
This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root.
Note: Administrators should always validate the hash of any upgrade image before uploading it to Cisco APIC and Cisco Cloud Network Controller.
Affected
445 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | application_policy_infrastructure_controller | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
vendor_cisco·2024-08-28·CVSS 6.5
CVE-2024-20478 [MEDIUM] CWE-250 Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.
This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root.
Note: Administrators should always validate the hash of a
Cisco
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20478 Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
CVE-2024-20478: Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator -level privileges to install a modified software image, leading to arbitrary code injection on an affected system. This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root . Note: Administrators should always valida
GHSA
GHSA-j3cr-gpf3-q8w2: A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, for
ghsa_unreviewed·2024-08-28
CVE-2024-20478 [MEDIUM] CWE-250 GHSA-j3cr-gpf3-q8w2: A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, for
A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.
This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root.
Note: Administrators should always validate the hash of any upgrade image before uploading it to Cisco APIC and Cisco Cloud Network Controller.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-28
Published