Vulnerability · Published Feb 26, 2025 · Assigned by cisco
CVE-2025-20119Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability
Medium 6.0
In plain English
A medium-severity race condition in Cisco Application Policy Infrastructure Controller (APIC) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Application Policy Infrastructure Controller (APIC) | 3.2(8d)3.2(1m)3.2(5e)4.1(2m)3.2(41d)3.2(3s)4.0(3c)4.1(1k) |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H