CVE-2019-1690: cisco application_policy_infrastructure_controller Improper Access Control
Vulnerability summary
CVE-2019-1690 is a medium (CVSS 6.5) Improper Access Control vulnerability in cisco application_policy_infrastructure_controller. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.5% of scored vulnerabilities.
Timeline
- 11-03-2019PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due to a lack of proper access control mechanisms for IPv6 link-local connectivity imposed on the management interface of an affected device. An attacker on the same physical network could exploit this vulnerability by attempting to connect to the IPv6 link-local address on the affected device. A successful exploit could allow the attacker to bypass default access control restrictions on an affected device. Cisco Application Policy Infrastructure Controller (APIC) devices running versions prior to 4.2(0.21c) are affected.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST4.3MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- application_policy_infrastructure_controller< 4.2\(0.21c\)
- cisco application policy infrastructure controller (apic)≥ unspecified, < 4.2(0.21c)
1 vendor · 2 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-apic-ipv6Vendor AdvisoryX Refsource CISCO