製品・ソフトウェアに関する情報
シスコシステムズの Cisco Application Policy Infrastructure Controller における競合状態に関する脆弱性
Title シスコシステムズの Cisco Application Policy Infrastructure Controller における競合状態に関する脆弱性
Summary

シスコシステムズの Cisco Application Policy Infrastructure Controller には、競合状態に関する脆弱性が存在します。

Possible impacts 情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 
Solution

ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。

Publication Date Feb. 26, 2025, midnight
Registration Date Aug. 1, 2025, 6:14 p.m.
Last Update Aug. 1, 2025, 6:14 p.m.
CVSS3.0 : 警告
Score 5.7
Vector CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected System
シスコシステムズ
Cisco Application Policy Infrastructure Controller 3.2(1l)
Cisco Application Policy Infrastructure Controller 3.2(1m)
Cisco Application Policy Infrastructure Controller 3.2(2l)
Cisco Application Policy Infrastructure Controller 3.2(2o)
Cisco Application Policy Infrastructure Controller 3.2(3i)
Cisco Application Policy Infrastructure Controller 3.2(3j)
Cisco Application Policy Infrastructure Controller 3.2(3n)
Cisco Application Policy Infrastructure Controller 3.2(3o)
Cisco Application Policy Infrastructure Controller 3.2(3r)
Cisco Application Policy Infrastructure Controller 3.2(3s)
Cisco Application Policy Infrastructure Controller 3.2(4d)
Cisco Application Policy Infrastructure Controller 3.2(4e)
Cisco Application Policy Infrastructure Controller 3.2(5d)
Cisco Application Policy Infrastructure Controller 3.2(5e)
Cisco Application Policy Infrastructure Controller 3.2(5f)
Cisco Application Policy Infrastructure Controller 3.2(6i)
Cisco Application Policy Infrastructure Controller 3.2(7f)
Cisco Application Policy Infrastructure Controller 3.2(7k)
Cisco Application Policy Infrastructure Controller 3.2(8d)
Cisco Application Policy Infrastructure Controller 3.2(9b)
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
No Changed Details Date of change
1 [2025年08月01日]
  掲載
Aug. 1, 2025, 6:14 p.m.

NVD Vulnerability Information
CVE-2025-20119
Summary

A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.

Publication Date Feb. 27, 2025, 2:15 a.m.
Registration Date Feb. 28, 2025, 4:02 a.m.
Last Update Feb. 27, 2025, 3:15 a.m.
Related information, measures and tools
Common Vulnerabilities List