CVE-2025-20118: Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability
First published: Wed Feb 26 2025(Updated: )
A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient masking of sensitive information that is displayed through system CLI commands. An attacker could exploit this vulnerability by using reconnaissance techniques at the device CLI. A successful exploit could allow the attacker to access sensitive information on an affected device that could be used for additional attacks.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Application Policy Infrastructure Controller (APIC) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20118?
CVE-2025-20118 is classified as a high-severity vulnerability due to its potential impact on sensitive information.
How do I fix CVE-2025-20118?
To mitigate CVE-2025-20118, ensure that your Cisco APIC software is updated to the latest version recommended by Cisco.
Who is affected by CVE-2025-20118?
CVE-2025-20118 affects systems running Cisco Application Policy Infrastructure Controller with administrative access.
What kind of attack can exploit CVE-2025-20118?
CVE-2025-20118 can be exploited by an authenticated local attacker with valid administrative credentials.
What type of information is at risk due to CVE-2025-20118?
CVE-2025-20118 could allow an attacker to access sensitive information stored on the affected Cisco APIC device.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/first-publish-date
- agent/severity
- agent/type
- agent/title
- agent/weakness
- agent/references
- agent/author
- agent/source
- agent/last-modified-date
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco application policy infrastructure controller (apic)