High severity · published Aug 28, 2024
CVE-2024-20478
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
7.2
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authenticated, remote attacker with Administrator-level privileges to install a modified software image, leading to arbitrary code injection on an affected system.
This vulnerability is due to insufficient signature validation of software images. An attacker could exploit this vulnerability by installing a modified software image. A successful exploit could allow the attacker to execute arbitrary code on the affected system and elevate their privileges to root.
Note: Administrators should always validate the hash of any upgrade image before uploading it to Cisco APIC and Cisco Cloud Network Controller.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cisco Application Policy Infrastructure Controller (APIC) · Cisco
3.2(8d); 2.2(1o); 1.2(2h); 2.2(2i); 1.2(1k); 2.2(1k); +34 more · source: vendor
AP
Application Policy Infrastructure Controller · Cisco
1.1(1d); 1.1(1j); 1.1(1n); 1.1(1o); 1.1(1r); 1.1(1s); +34 more · source: NVD, CISA
Affected product
CA
Cisco Application Policy Infrastructure Controller (APIC)
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20478
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-priv-esc-uYQJjnuU
More from Cisco Application Policy Infrastructure Controller (APIC)
9.8
CVE-2026-76500
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities
9.8
CVE-2026-76498
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities
9.8
CVE-2026-76499
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
6.7
CVE-2025-20117
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability
6.5
CVE-2026-76488
Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerability