Action not permitted
Modal body text goes here.
Modal Title
Modal Body
ghsa-62xm-fg6r-jmpc
Vulnerability from github
Published
2025-02-26 18:30
Modified
2025-02-26 18:30
Severity ?
Details
A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
{ affected: [], aliases: [ "CVE-2025-20119", ], database_specific: { cwe_ids: [ "CWE-362", ], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2025-02-26T17:15:22Z", severity: "MODERATE", }, details: "A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.\n\nThis vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.", id: "GHSA-62xm-fg6r-jmpc", modified: "2025-02-26T18:30:39Z", published: "2025-02-26T18:30:39Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2025-20119", }, { type: "WEB", url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", type: "CVSS_V3", }, ], }
cve-2025-20119
Vulnerability from cvelistv5
Published
2025-02-26 16:23
Modified
2025-03-03 19:02
Severity ?
Summary
A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Application Policy Infrastructure Controller (APIC) |
Version: 3.2(8d) Version: 3.2(1m) Version: 3.2(5e) Version: 4.1(2m) Version: 3.2(41d) Version: 3.2(3s) Version: 4.0(3c) Version: 4.1(1k) Version: 3.2(4d) Version: 4.2(2e) Version: 4.2(3j) Version: 4.2(3n) Version: 4.0(1h) Version: 4.1(1l) Version: 3.2(9f) Version: 4.2(3l) Version: 4.2(2g) Version: 3.2(7k) Version: 3.2(9b) Version: 3.2(3j) Version: 4.1(2u) Version: 4.2(1l) Version: 4.1(1a) Version: 4.0(3d) Version: 3.2(4e) Version: 4.1(1i) Version: 3.2(5f) Version: 3.2(1l) Version: 4.2(1i) Version: 4.1(2o) Version: 4.2(1g) Version: 4.1(2g) Version: 4.2(2f) Version: 3.2(6i) Version: 3.2(3i) Version: 3.2(3n) Version: 4.1(2x) Version: 3.2(5d) Version: 4.2(3q) Version: 4.1(1j) Version: 4.1(2w) Version: 3.2(2o) Version: 3.2(3r) Version: 4.0(2c) Version: 4.1(2s) Version: 3.2(7f) Version: 3.2(3o) Version: 3.2(2l) Version: 4.2(1j) Version: 4.2(4i) Version: 3.2(9h) Version: 5.0(1k) Version: 4.2(4k) Version: 5.0(1l) Version: 5.0(2e) Version: 4.2(4o) Version: 4.2(4p) Version: 5.0(2h) Version: 4.2(5k) Version: 4.2(5l) Version: 4.2(5n) Version: 5.1(1h) Version: 4.2(6d) Version: 5.1(2e) Version: 4.2(6g) Version: 4.2(6h) Version: 5.1(3e) Version: 3.2(10e) Version: 4.2(6l) Version: 4.2(7f) Version: 5.1(4c) Version: 4.2(6o) Version: 5.2(1g) Version: 5.2(2e) Version: 4.2(7l) Version: 3.2(10f) Version: 5.2(2f) Version: 5.2(2g) Version: 4.2(7q) Version: 5.2(2h) Version: 5.2(3f) Version: 5.2(3e) Version: 5.2(3g) Version: 4.2(7r) Version: 4.2(7s) Version: 5.2(4d) Version: 5.2(4e) Version: 4.2(7t) Version: 5.2(5d) Version: 3.2(10g) Version: 5.2(5c) Version: 6.0(1g) Version: 4.2(7u) Version: 5.2(5e) Version: 5.2(4f) Version: 5.2(6e) Version: 6.0(1j) Version: 5.2(6g) Version: 5.2(7f) Version: 4.2(7v) Version: 5.2(7g) Version: 6.0(2h) Version: 4.2(7w) Version: 5.2(6h) Version: 5.2(4h) Version: 5.2(8d) Version: 6.0(2j) Version: 5.2(8e) Version: 6.0(3d) Version: 6.0(3e) Version: 5.2(8f) Version: 5.2(8g) Version: 5.3(1d) Version: 5.2(8h) Version: 6.0(4c) Version: 5.3(2a) Version: 5.2(8i) Version: 6.0(5h) Version: 5.3(2b) Version: 6.0(3g) Version: 6.0(5j) Version: 5.3(2c) Version: 6.0(6c) Version: 6.1(1f) Version: 6.0(7e) Version: 5.3(2d) Version: 6.0(8d) Version: 5.3(2e) |
{ containers: { adp: [ { metrics: [ { other: { content: { id: "CVE-2025-20119", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-02-26T17:21:01.401418Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-03-03T19:02:59.455Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "Cisco Application Policy Infrastructure Controller (APIC)", vendor: "Cisco", versions: [ { status: "affected", version: "3.2(8d)", }, { status: "affected", version: "3.2(1m)", }, { status: "affected", version: "3.2(5e)", }, { status: "affected", version: "4.1(2m)", }, { status: "affected", version: "3.2(41d)", }, { status: "affected", version: "3.2(3s)", }, { status: "affected", version: "4.0(3c)", }, { status: "affected", version: "4.1(1k)", }, { status: "affected", version: "3.2(4d)", }, { status: "affected", version: "4.2(2e)", }, { status: "affected", version: "4.2(3j)", }, { status: "affected", version: "4.2(3n)", }, { status: "affected", version: "4.0(1h)", }, { status: "affected", version: "4.1(1l)", }, { status: "affected", version: "3.2(9f)", }, { status: "affected", version: "4.2(3l)", }, { status: "affected", version: "4.2(2g)", }, { status: "affected", version: "3.2(7k)", }, { status: "affected", version: "3.2(9b)", }, { status: "affected", version: "3.2(3j)", }, { status: "affected", version: "4.1(2u)", }, { status: "affected", version: "4.2(1l)", }, { status: "affected", version: "4.1(1a)", }, { status: "affected", version: "4.0(3d)", }, { status: "affected", version: "3.2(4e)", }, { status: "affected", version: "4.1(1i)", }, { status: "affected", version: "3.2(5f)", }, { status: "affected", version: "3.2(1l)", }, { status: "affected", version: "4.2(1i)", }, { status: "affected", version: "4.1(2o)", }, { status: "affected", version: "4.2(1g)", }, { status: "affected", version: "4.1(2g)", }, { status: "affected", version: "4.2(2f)", }, { status: "affected", version: "3.2(6i)", }, { status: "affected", version: "3.2(3i)", }, { status: "affected", version: "3.2(3n)", }, { status: "affected", version: "4.1(2x)", }, { status: "affected", version: "3.2(5d)", }, { status: "affected", version: "4.2(3q)", }, { status: "affected", version: "4.1(1j)", }, { status: "affected", version: "4.1(2w)", }, { status: "affected", version: "3.2(2o)", }, { status: "affected", version: "3.2(3r)", }, { status: "affected", version: "4.0(2c)", }, { status: "affected", version: "4.1(2s)", }, { status: "affected", version: "3.2(7f)", }, { status: "affected", version: "3.2(3o)", }, { status: "affected", version: "3.2(2l)", }, { status: "affected", version: "4.2(1j)", }, { status: "affected", version: "4.2(4i)", }, { status: "affected", version: "3.2(9h)", }, { status: "affected", version: "5.0(1k)", }, { status: "affected", version: "4.2(4k)", }, { status: "affected", version: "5.0(1l)", }, { status: "affected", version: "5.0(2e)", }, { status: "affected", version: "4.2(4o)", }, { status: "affected", version: "4.2(4p)", }, { status: "affected", version: "5.0(2h)", }, { status: "affected", version: "4.2(5k)", }, { status: "affected", version: "4.2(5l)", }, { status: "affected", version: "4.2(5n)", }, { status: "affected", version: "5.1(1h)", }, { status: "affected", version: "4.2(6d)", }, { status: "affected", version: "5.1(2e)", }, { status: "affected", version: "4.2(6g)", }, { status: "affected", version: "4.2(6h)", }, { status: "affected", version: "5.1(3e)", }, { status: "affected", version: "3.2(10e)", }, { status: "affected", version: "4.2(6l)", }, { status: "affected", version: "4.2(7f)", }, { status: "affected", version: "5.1(4c)", }, { status: "affected", version: "4.2(6o)", }, { status: "affected", version: "5.2(1g)", }, { status: "affected", version: "5.2(2e)", }, { status: "affected", version: "4.2(7l)", }, { status: "affected", version: "3.2(10f)", }, { status: "affected", version: "5.2(2f)", }, { status: "affected", version: "5.2(2g)", }, { status: "affected", version: "4.2(7q)", }, { status: "affected", version: "5.2(2h)", }, { status: "affected", version: "5.2(3f)", }, { status: "affected", version: "5.2(3e)", }, { status: "affected", version: "5.2(3g)", }, { status: "affected", version: "4.2(7r)", }, { status: "affected", version: "4.2(7s)", }, { status: "affected", version: "5.2(4d)", }, { status: "affected", version: "5.2(4e)", }, { status: "affected", version: "4.2(7t)", }, { status: "affected", version: "5.2(5d)", }, { status: "affected", version: "3.2(10g)", }, { status: "affected", version: "5.2(5c)", }, { status: "affected", version: "6.0(1g)", }, { status: "affected", version: "4.2(7u)", }, { status: "affected", version: "5.2(5e)", }, { status: "affected", version: "5.2(4f)", }, { status: "affected", version: "5.2(6e)", }, { status: "affected", version: "6.0(1j)", }, { status: "affected", version: "5.2(6g)", }, { status: "affected", version: "5.2(7f)", }, { status: "affected", version: "4.2(7v)", }, { status: "affected", version: "5.2(7g)", }, { status: "affected", version: "6.0(2h)", }, { status: "affected", version: "4.2(7w)", }, { status: "affected", version: "5.2(6h)", }, { status: "affected", version: "5.2(4h)", }, { status: "affected", version: "5.2(8d)", }, { status: "affected", version: "6.0(2j)", }, { status: "affected", version: "5.2(8e)", }, { status: "affected", version: "6.0(3d)", }, { status: "affected", version: "6.0(3e)", }, { status: "affected", version: "5.2(8f)", }, { status: "affected", version: "5.2(8g)", }, { status: "affected", version: "5.3(1d)", }, { status: "affected", version: "5.2(8h)", }, { status: "affected", version: "6.0(4c)", }, { status: "affected", version: "5.3(2a)", }, { status: "affected", version: "5.2(8i)", }, { status: "affected", version: "6.0(5h)", }, { status: "affected", version: "5.3(2b)", }, { status: "affected", version: "6.0(3g)", }, { status: "affected", version: "6.0(5j)", }, { status: "affected", version: "5.3(2c)", }, { status: "affected", version: "6.0(6c)", }, { status: "affected", version: "6.1(1f)", }, { status: "affected", version: "6.0(7e)", }, { status: "affected", version: "5.3(2d)", }, { status: "affected", version: "6.0(8d)", }, { status: "affected", version: "5.3(2e)", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.\r\n\r\nThis vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.", }, ], exploits: [ { lang: "en", value: "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that is described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", version: "3.1", }, format: "cvssV3_1", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-362", description: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", lang: "en", type: "cwe", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-26T17:13:44.068Z", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "cisco-sa-apic-multi-vulns-9ummtg5", url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5", }, ], source: { advisory: "cisco-sa-apic-multi-vulns-9ummtg5", defects: [ "CSCwk18865", ], discovery: "EXTERNAL", }, title: "Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability", }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2025-20119", datePublished: "2025-02-26T16:23:37.170Z", dateReserved: "2024-10-10T19:15:13.211Z", dateUpdated: "2025-03-03T19:02:59.455Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.