Lucene search

CiscoCVE-2019-1682

HistoryMay 03, 2019 - 3:29 p.m.

CVE-2019-1682

2019-05-0315:29:00

CWE-264

CWE-20

cisco

web.nvd.nist.gov

cisco

apic

vulnerability

fuse filesystem

privilege escalation

cve-2019-1682

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an authenticated, local attacker to escalate privileges to root on an affected device. The vulnerability is due to insufficient input validation for certain command strings issued on the CLI of the affected device. An attacker with write permissions for files within a readable folder on the device could alter certain definitions in the affected file. A successful exploit could allow an attacker to cause the underlying FUSE driver to execute said crafted commands, elevating the attacker’s privileges to root on an affected device.

Affected configurations

Nvd

Node

ciscoapplication_policy_infrastructure_controllerRange<4.1\(1i\)

VendorProductVersionCPE
ciscoapplication_policy_infrastructure_controller*cpe:2.3:a:cisco:application_policy_infrastructure_controller:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	application_policy_infrastructure_controller	*	cpe:2.3:a:cisco:application_policy_infrastructure_controller::::::::

CNA Affected

[
  {
    "product": "Cisco Application Policy Infrastructure Controller (APIC)",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "4.1(1i)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-priv-escalation

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-1682