CVE-2025-20119

Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability

State
Published
Severity
6.0 Medium
Published
Feb 26, 2025
Updated
Mar 3, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.

Scores

CVSSScoreVectorSource
3.16.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Hcisco

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
Cisco Application Policy Infrastructure Controller (APIC)Cisco
  • 3.2(8d)Affected
  • 3.2(1m)Affected
  • 3.2(5e)Affected
  • 4.1(2m)Affected
  • 3.2(41d)Affected
  • 3.2(3s)Affected
  • 4.0(3c)Affected
  • 4.1(1k)Affected
  • 3.2(4d)Affected
  • 4.2(2e)Affected
  • 4.2(3j)Affected
  • 4.2(3n)Affected
  • 4.0(1h)Affected
  • 4.1(1l)Affected
  • 3.2(9f)Affected
  • 4.2(3l)Affected
  • 4.2(2g)Affected
  • 3.2(7k)Affected
  • 3.2(9b)Affected
  • 3.2(3j)Affected
  • 4.1(2u)Affected
  • 4.2(1l)Affected
  • 4.1(1a)Affected
  • 4.0(3d)Affected
  • 3.2(4e)Affected
  • and 103 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.