CVE-2015-4235: cisco application_policy_infrastructure_controller_\(apic\)
Vulnerability summary
CVE-2015-4235 is a high (CVSS 9.0) vulnerability in cisco application_policy_infrastructure_controller_\(apic\). EPSS estimates a 2.25% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities.
Timeline
- 24-07-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.25%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.25% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- application_policy_infrastructure_controller_\(apic\)1.0\(1e\)
- nx-os11.0\(1b\) | 11.0\(1c\) | 11.0\(1d\) | 11.0\(1e\) | 11.0\(2j\) | 11.0\(2m\) | 11.0\(3f\) | 11.0\(3i\) | 11.0\(3k\) | 11.0\(3n\) | 11.0\(4h\)
1 vendor · 2 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-apicVendor AdvisoryX Refsource CISCO