Unscored severity · published Jul 24, 2015
CVE-2015-4235
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Application Policy Infrastructure Controller (apic) · Cisco
1.0(1e) · source: NVD
NX
Nx-os · Cisco
11.0(1b); 11.0(1c); 11.0(1d); 11.0(1e); 11.0(2j); 11.0(2m); +5 more · source: NVD
Affected product
AP
Application Policy Infrastructure Controller (apic)
Cisco