Riskcovery

CVE-2025-20118

Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability

State
Published
Severity
4.4 Medium
Published
Feb 26, 2025
Updated
Mar 3, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to insufficient masking of sensitive information that is displayed through system CLI commands. An attacker could exploit this vulnerability by using reconnaissance techniques at the device CLI. A successful exploit could allow the attacker to access sensitive information on an affected device that could be used for additional attacks.

Scores

CVSSScoreVectorSource
3.14.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Ncisco

Weaknesses

  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

Affected Products

ProductVersions
Cisco Application Policy Infrastructure Controller (APIC)Cisco
  • 3.2(8d)Affected
  • 3.2(1m)Affected
  • 3.2(5e)Affected
  • 4.1(2m)Affected
  • 3.2(41d)Affected
  • 3.2(3s)Affected
  • 4.0(3c)Affected
  • 4.1(1k)Affected
  • 3.2(4d)Affected
  • 4.2(2e)Affected
  • 4.2(3j)Affected
  • 4.2(3n)Affected
  • 4.0(1h)Affected
  • 4.1(1l)Affected
  • 3.2(9f)Affected
  • 4.2(3l)Affected
  • 4.2(2g)Affected
  • 3.2(7k)Affected
  • 3.2(9b)Affected
  • 3.2(3j)Affected
  • 4.1(2u)Affected
  • 4.2(1l)Affected
  • 4.1(1a)Affected
  • 4.0(3d)Affected
  • 3.2(4e)Affected
  • and 103 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.