PT-2021-5381 · Cisco · Cisco Apic+1

Arthur Vidineyev · Published 2021-08-25 · Updated 2022-04-26 · CVE-2021-1580

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the web UI and API endpoints of the affected system, which could allow a remote attacker to perform a command injection or file upload attack. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Command Injection

OS Command Injection

Weakness Enumeration

CWE-284

CWE-77

CWE-78

Related Identifiers

BDU:2021-06217

CVE-2021-1580

Affected Products

Cisco Apic

Cisco Cloud Apic

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06217 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1580 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1580 · Vendor Advisory
• https://t.me/cvenotify/20109 · Telegram Post