Medium severity · published Feb 26, 2025
CVE-2025-20118
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient masking of sensitive information that is displayed through system CLI commands. An attacker could exploit this vulnerability by using reconnaissance techniques at the device CLI. A successful exploit could allow the attacker to access sensitive information on an affected device that could be used for additional attacks.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cisco Application Policy Infrastructure Controller (APIC) · Cisco
3.2(8d); 3.2(1m); 3.2(5e); 4.1(2m); 3.2(41d); 3.2(3s); +34 more · source: vendor
AP
Application Policy Infrastructure Controller · Cisco
3.2(1l); 3.2(1m); 3.2(2l); 3.2(2o); 3.2(3i); 3.2(3j); +34 more · source: NVD
Affected product
CA
Cisco Application Policy Infrastructure Controller (APIC)
Cisco
More from Cisco Application Policy Infrastructure Controller (APIC)
9.8
CVE-2026-76500
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities
9.8
CVE-2026-76498
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities
9.8
CVE-2026-76499
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
7.2
CVE-2024-20478
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
6.7
CVE-2025-20117
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability