PT-2019-2117 · Cisco · Cisco Application Policy Infrastructure Controller (Apic)

Publicado 2019-05-01 · Atualizado 2021-10-29 · CVE-2019-1586

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) Software (affected versions not specified)

Description A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The issue is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device. An attacker could exploit this by retrieving data from the physical disk on the affected partition(s), potentially allowing them to retrieve encryption keys and further decrypt other data and sensitive information on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-320

CWE-459

Identificadores relacionados

BDU:2019-01874

CVE-2019-1586

Produtos afetados

Cisco Application Policy Infrastructure Controller (Apic)

Referências · 8

• https://bdu.fstec.ru/vul/2019-01874 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-encrypt · Aviso do Fabricante
• https://securityfocus.com/bid/108158 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1586 · Nota de Segurança
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvn09800 · Nota
• https://t.me/cvenotify/22653 · Publicação no Telegram
• http://securityfocus.com/bid/108158 · Nota
• https://osv.dev/vulnerability/CVE-2019-1586 · Aviso do Fabricante