CVE-2025-20119— Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-20119
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco APIC 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco APIC是美国思科（Cisco）公司的一款用于 Cisco ACI 交换矩阵自动化和管理的软件。可进行策略实施、健康监控、网络配置等。 Cisco APIC存在安全漏洞，该漏洞源于系统文件处理存在竞争条件，允许本地认证用户覆盖关键系统文件，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Application Policy Infrastructure Controller (APIC) | 3.2(8d) | - |
II. Public POCs for CVE-2025-20119
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-20119
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2025-02-26 · 6 CVEs total
| CVE-2025-20111 | 7.4 HIGH | Cisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet Denial of Service Vulnerability |
| CVE-2025-20117 | 5.1 MEDIUM | Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnera |
| CVE-2025-20161 | 5.1 MEDIUM | Cisco NX-OS Software Command Injection Vulnerability |
| CVE-2025-20116 | 4.8 MEDIUM | Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerabili |
| CVE-2025-20118 | 4.4 MEDIUM | Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to |
IV. Related Vulnerabilities
- CVE-2026-20107
Cisco Application Policy Infrastructure Controller Denial of - CVE-2025-20118
Cisco Application Policy Infrastructure Controller Authentic - CVE-2025-20117
Cisco Application Policy Infrastructure Controller Authentic - CVE-2025-20116
Cisco Application Policy Infrastructure Controller Stored Cr - CVE-2024-20478
Cisco Application Policy Infrastructure Controller App Privi
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
V. Comments for CVE-2025-20119
No comments yet