RCE in Cisco Application Policy Infrastructure Controller (Apic)
CVE-2025-20117
A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must hav…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.000 (13.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Cisco Application Policy Infrastructure Controller (Apic) — versions 3.2(8d), 3.2(1m), 3.2(5e)
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-20117?
- CVE-2025-20117 is a medium-severity vulnerability in Cisco Application Policy Infrastructure Controller (Apic), classified under Command Injection. CVSS score: 5.1/10. Published 2025-02-26.
- How severe is CVE-2025-20117?
- Medium severity. CVSS v3 base score is 5.1 out of 10.