VIR Vulnerability Intelligence Relay

CVE-2017-6768

high
Published 2017-08-17 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.8

Description

A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure Controller (APIC) devices could allow an authenticated, local attacker to gain root-level privileges. The vulnerability is due to a custom executable system file that was built to use relative search paths for libraries without properly validating the library to be loaded. An attacker could exploit this vulnerability by authenticating to the device and loading a malicious library that can escalate the privilege level. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. The attacker must have valid user credentials to log in to the device. Cisco Bug IDs: CSCvc96087. Known Affected Releases: 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1).

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
cisco ciscoapplication_policy_infrastructure_controller1.1\(0.920a\)
cisco ciscoapplication_policy_infrastructure_controller1.1\(1j\)
cisco ciscoapplication_policy_infrastructure_controller1.1\(3f\)
cisco ciscoapplication_policy_infrastructure_controller1.2\(2\)
cisco ciscoapplication_policy_infrastructure_controller1.2\(3\)
cisco ciscoapplication_policy_infrastructure_controller1.2.2
cisco ciscoapplication_policy_infrastructure_controller1.2_base
cisco ciscoapplication_policy_infrastructure_controller1.3\(1\)
cisco ciscoapplication_policy_infrastructure_controller1.3\(2\)
cisco ciscoapplication_policy_infrastructure_controller1.3\(2f\)
cisco ciscoapplication_policy_infrastructure_controller2.0\(1\)
cisco ciscoapplication_policy_infrastructure_controller2.0_base

References

CWEs

CWE-426

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.