Read the docs
TI-2017-04522 Aliases CVE-2017-6768GHSA-869x-pmmv-pm7c

Untrusted search path in Cisco Application Policy Infrastructure Controller

Priority LOW 34CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure Controller (APIC) devices could allow an authenticated, local attacker to gain root-level privileges. The vulnerability is due to a custom executable system file that was built to use relative search paths for libraries without properly validating the library to be loaded. An attacker could exploit this vulnerability by authenticating to the device and loading a malicious library that can escalate the privilege level. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. The attacker must have valid user credentials to log in to the device. Cisco Bug IDs: CSCvc96087. Known Affected Releases: 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1).

Why it matters now

EPSS 0.00422 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoApplication Policy Infrastructure Controller (APIC)1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1)—No fix listedCNA
  • Application Policy Infrastructure Controller (APIC) VendorCisco Affected 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1) Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(0.920a\):*:*:*:*:*:*:*1.1(0.920a)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(1j\):*:*:*:*:*:*:*1.1(1j)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(3f\):*:*:*:*:*:*:*1.1(3f)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2\(2\):*:*:*:*:*:*:*1.2(2)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2\(3\):*:*:*:*:*:*:*1.2(3)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2_base:*:*:*:*:*:*:*1.2_baseVulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(1\):*:*:*:*:*:*:*1.3(1)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(2\):*:*:*:*:*:*:*1.3(2)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(2f\):*:*:*:*:*:*:*1.3(2f)VulnerableCisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(0.920a\):*:*:*:*:*:*:* Versions 1.1(0.920a) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(1j\):*:*:*:*:*:*:* Versions 1.1(1j) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1\(3f\):*:*:*:*:*:*:* Versions 1.1(3f) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2\(2\):*:*:*:*:*:*:* Versions 1.2(2) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2\(3\):*:*:*:*:*:*:* Versions 1.2(3) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.2_base:*:*:*:*:*:*:* Versions 1.2_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(1\):*:*:*:*:*:*:* Versions 1.3(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(2\):*:*:*:*:*:*:* Versions 1.3(2) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.3\(2f\):*:*:*:*:*:*:* Versions 1.3(2f) Vulnerable ·Cisco
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.0\(1\):*:*:*:*:*:*:*2.0(1)VulnerableCisco
cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.0_base:*:*:*:*:*:*:*2.0_baseVulnerableCisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.0\(1\):*:*:*:*:*:*:* Versions 2.0(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.0_base:*:*:*:*:*:*:* Versions 2.0_base Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6768
  2. 2026-10-03 Alias added: GHSA-869x-pmmv-pm7c

References

Advisory 1

  • TI-2021-01115 Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2021-01120 Cisco Application Services Engine Unauthorized Access Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2021-01123 Cisco Application Services Engine Unauthorized Access Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2021-01301 Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2021-01305 Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities CVSS 3.1CRITICAL 9.1
  • TI-2021-01302 Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences