CVE-2021-1577: Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability

Q: What is the vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability?

The vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability is CVE-2021-1577.

Q: What is the severity rating of CVE-2021-1577?

CVE-2021-1577 has a severity rating of 9.1 - critical.

Q: Which software versions are affected by CVE-2021-1577?

CVE-2021-1577 affects Cisco Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), Cisco Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e), Cisco Cloud Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Cloud Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), and Cisco Cloud Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e).

Q: What is the vulnerability description of CVE-2021-1577?

CVE-2021-1577 is a vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) that allows an unauthenticated, remote attacker to read or write arbitrary files on an affected system.

Q: How can I fix CVE-2021-1577?

To fix CVE-2021-1577, it is recommended to apply the necessary patches and updates provided by Cisco.

Published Aug 25, 2021

Updated

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.

Affected Software

6 affected components

Cisco Application Policy Infrastructure Controller<3.2\(10e\)

Cisco Application Policy Infrastructure Controller>=4.0<4.2\(6h\)

Cisco Application Policy Infrastructure Controller>=5.0<5.1\(3e\)

Cisco Cloud Application Policy Infrastructure Controller<3.2\(10e\)

Cisco Cloud Application Policy Infrastructure Controller>=4.0<4.2\(6h\)

Cisco Cloud Application Policy Infrastructure Controller>=5.0<5.1\(3e\)

Event History

Aug 25, 2021

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability?

The vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability is CVE-2021-1577.

What is the severity rating of CVE-2021-1577?

CVE-2021-1577 has a severity rating of 9.1 - critical.

Which software versions are affected by CVE-2021-1577?

CVE-2021-1577 affects Cisco Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), Cisco Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e), Cisco Cloud Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Cloud Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), and Cisco Cloud Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e).

What is the vulnerability description of CVE-2021-1577?

CVE-2021-1577 is a vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) that allows an unauthenticated, remote attacker to read or write arbitrary files on an affected system.

How can I fix CVE-2021-1577?