PT-2019-2117 · Cisco · Cisco Application Policy Infrastructure Controller (Apic)

Published 2019-05-01 · Updated 2021-10-29 · CVE-2019-1586

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) Software (affected versions not specified)

Description A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The issue is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device. An attacker could exploit this by retrieving data from the physical disk on the affected partition(s), potentially allowing them to retrieve encryption keys and further decrypt other data and sensitive information on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-320

CWE-459

Related Identifiers

BDU:2019-01874

CVE-2019-1586

Affected Products

Cisco Application Policy Infrastructure Controller (Apic)

References · 8

• https://bdu.fstec.ru/vul/2019-01874 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-encrypt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1586 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1586 · Vendor Advisory
• https://securityfocus.com/bid/108158 · Note
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvn09800 · Note
• https://t.me/cvenotify/22653 · Telegram Post
• http://securityfocus.com/bid/108158 · Note