Industry News

APIC Vulnerability in CISCO’s SDN Controller Allows Unauthenticated Remote Root Access

A vulnerability found in CISCO’s SDN controller could enable an attacker to exploit an improper implementation of access controls in the APIC file system and remotely access the APIC as a root user.

The SDN (software defined-network) controller is a collection of modules that manages data flow between servers and routers/switches to enable intelligent networking. Attackers exploiting this vulnerability will gain access to all commands and files on the controller to start modifying the system.

“A vulnerability in the cluster management configuration of the Cisco Application Policy Infrastructure Controller (APIC) and the Cisco Nexus 9000 Series ACI Mode Switch could allow an authenticated, remote attacker to access the APIC as the root user,” reads the CISCO advisory. “The vulnerability is due to improper implementation of access controls in the APIC filesystem.”

Since there are no known workarounds for the vulnerability, CISCO has already issued a patch that fixes the flaw, and it strongly encourages everyone to download and install it. The products known to be affected by the vulnerability are APIC controllers running software versions prior to 1.1(1j), 1.0(3o) and 1.0(4o), and Cisco Nexus 9000 Series ACI Mode Switches running software versions prior to Release 11.1(1j) and 11.0(4o).

Although CISCO knows of no in-the-wild exploitation of this vulnerability, an attack using on this vulnerability could be reported any time.

“The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory,” reads the advisory. “This vulnerability was reported to Cisco during an internal security evaluation.”

Businesses relying on CISCO’s SDN controllers to manage a network’s topography should immediately apply the latest patches to avoid breaches using this vulnerability.

About the author

Liviu ARSENE

Liviu Arsene is the proud owner of the secret to the fountain of never-ending energy. That's what's been helping him work his everything off as a passionate tech news editor for the past couple of years. He is the youngest and most restless member of the Bitdefender writer team and he covers mobile malware and security topics with fervor and a twist. His passions revolve around gadgets and technology, and he's always ready to write about what's hot and trendy out there in geek universe.

2 Comments

Click here to post a comment