CVE-2021-1577: Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
First published: Wed Aug 25 2021(Updated: )
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Application Policy Infrastructure Controller | <3.2\(10e\) | |
| Cisco Application Policy Infrastructure Controller | >=4.0<4.2\(6h\) | |
| Cisco Application Policy Infrastructure Controller | >=5.0<5.1\(3e\) | |
| Cisco Cloud Application Policy Infrastructure Controller | <3.2\(10e\) | |
| Cisco Cloud Application Policy Infrastructure Controller | >=4.0<4.2\(6h\) | |
| Cisco Cloud Application Policy Infrastructure Controller | >=5.0<5.1\(3e\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability?
The vulnerability ID for this Cisco Application Policy Infrastructure Controller (APIC) vulnerability is CVE-2021-1577.
What is the severity rating of CVE-2021-1577?
CVE-2021-1577 has a severity rating of 9.1 - critical.
Which software versions are affected by CVE-2021-1577?
CVE-2021-1577 affects Cisco Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), Cisco Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e), Cisco Cloud Application Policy Infrastructure Controller versions up to and including 3.2(10e), Cisco Cloud Application Policy Infrastructure Controller versions between 4.0 and 4.2(6h), and Cisco Cloud Application Policy Infrastructure Controller versions between 5.0 and 5.1(3e).
What is the vulnerability description of CVE-2021-1577?
CVE-2021-1577 is a vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) that allows an unauthenticated, remote attacker to read or write arbitrary files on an affected system.
How can I fix CVE-2021-1577?
To fix CVE-2021-1577, it is recommended to apply the necessary patches and updates provided by Cisco.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/cisco
- canonical/cisco application policy infrastructure controller
- version/cisco application policy infrastructure controller/4.0
- version/cisco application policy infrastructure controller/5.0
- canonical/cisco cloud application policy infrastructure controller
- version/cisco cloud application policy infrastructure controller/4.0
- version/cisco cloud application policy infrastructure controller/5.0