CVE-2019-1690

A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due to a lack of proper access control mechanisms for IPv6 link-local connectivity imposed on the management interface of an affected device. An attacker on the same physical network could exploit this vulnerability by attempting to connect to the IPv6 link-local address on the affected device. A successful exploit could allow the attacker to bypass default access control restrictions on an affected device. Cisco Application Policy Infrastructure Controller (APIC) devices running versions prior to 4.2(0.21c) are affected.

• CWE-284

• http://www.securityfocus.com/bid/107317Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-apic-ipv6Vendor Advisory
• http://www.securityfocus.com/bid/107317Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-apic-ipv6Vendor Advisory

Published

Mar 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16894download.php in inoERP 4.15 allows SQL injection through ins…9.8
• CVE-2019-16895Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16896In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (…7.8
• CVE-2019-16897In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total…9.8
• CVE-2019-16898Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16899In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Fa…7.5
• CVE-2019-16900Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Wr…7.5
• CVE-2019-16901Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Hand…7.5
• CVE-2019-16902In the ARforms plugin 3.7.1 for WordPress, arf_delete_file i…7.5
• CVE-2019-16903Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/P…5.3
• CVE-2019-16904TeamPass 2.1.27.36 allows Stored XSS by setting a crafted pa…5.4
• CVE-2019-16905OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled wi…7.8