CVE-2015-4235 - CVE House

Back to Database

Status published Critical CVE-2015-4235

Cisco Application Policy Infrastructure Controller (APIC) devices with software before...

9 CVSS

Vulnerability Description

Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-4235

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from cisco

View All →

OpenH264 Decoding Functions Heap Overflow Vulnerability

Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow...

A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0...

A denial-of-service issue in Cisco Unified IP Conference Station 7937G...

Affected Vendor

cisco

View all reports →

Affected Software

application policy infrastructure controller \(apic\), nx-os

Vulnerable Versions:

1.0\(1e\), 11.0\(1b\), 11.0\(1c\), 11.0\(1d\), 11.0\(1e\), 11.0\(2j\), 11.0\(2m\), 11.0\(3f\), 11.0\(3i\), 11.0\(3k\), 11.0\(3n\), 11.0\(4h\)

Timeline

Official Publish: July 24th, 2015

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.