Cisco Application Policy Infrastructure Controller Unauthorized File Access (cisco-sa-apic-info-priv-enAdB5vD)

#TRUSTED 1f13ca450d2cdd2c60530c88eae6bf6cd285a1f5caba49cb3ed1e7b88a1e28d4858bb1316bac3b9e7f30a4e0f3dbd8063812f3b117231c83ceeb7ca15339b24c30828f3b03f796cd283195f0a794f8bb9f6fba40fabd45a7a0772ed3fa84fab48dd73eea8df7c795bcec226e015a7f91ca83b1605e831c5a44ec99f6286c4802459563a4cd41da848fa5b66cb6826a55849090e7edf9f280cbeb028415a4472702b6dc699ccea4f1332dd4844a819b4a908b666ff67fcad045c4d8f390f60b2eed1d017bf87cdaa459764fe34da1f2a75aeef219e09bf77d8d16564c8d0e848cedee6cddf7db2a7e1df206946f6f299ddef0a22e665668a75c1fb97c27c0d5e8c2f7b3c501d1fb51ceea2ebf15acce2048ccc0d6e9dffdb8c7c9e712881eff6fbe4c3c4d97f2ba8b492b03c8e74b0290af88c299308d74ff7d5b03c334d931c32d69c417f05f7eb78ea380c67fb7e3ffdc9d7b7d40b1bc1be4382481628b2952770934747d38b38825b1fa4bc4badcd453cc0c19f51df58504e28b4e3b0bda4ae0e4b21c5c14dc9bde51fc767d8297170ba9d00e023b449fa69853f06719d5ef2a822da24094792266fc586da9ee69cc3ca706a70c4db09a07ab2de0f59ee7b9957442959772a2f58556672143eca26d2d16514c7e20a059ef1afa3e724ec4faf12b4421b0ddc13f158577d91289081390f9b924e1b28f885a8c5c0239faad65
#TRUST-RSA-SHA256 2c319258b8824affb105e257181fac2fa69ca489e9734a049cbd996a86292993d8d6aa1bf9d2a121ef584f011979a1a3fdc3c25cf10be4abad34ba0a8b2e81fc0fe525effef27c7e86e0bb37dbdc7872128c17cede903dafcf27864163d9a5e60cb10363d8fa303d810f1b4bafd3a144106c316fdbe706caff8706d89aae6835fe12c0600bca198c53380475f180248507219d3c43cd3cbde03163171c69da533738e4c6bde821dba807dc48b840a7a810a6a003ffc71d75c5e006d98bd9daa5a89651e097c329759e2f1c72de37fd788b436f054467c4fabd3feb421741bb1fb16ea06514c5988ae14ecafa4e157287331baad73020cc90e0e5f9a4915b1758723d8879fa877f8c57d929aece4df4d79245d25a6038bd73608248ba516f00167bfe10459096b37d40f69e4455fcc30f7c0b19a8744a0d7f40c67acd904ef9062890bc1e4f85256221187feb7eb66ecbc1d4a58f61957eaf6e397f489ca16e7bf4a6fd877fb4031e8a4680fb05598295732fc84ff74148f99746609f1c1c61a2d48d03b70466ac3c1d4f57a8fe5eb6713679e9335d92b15554a754fb56e37b70afa8e9256405c5ee9b40e3de6bfe910184abd3d612c82b227d302907230639bca59b89b05ed527a5ad4992a15eec42928e47567b3771871150060a87b4a58e8737a7cb4ebfeeb893028b6930a827ec894646bf59a0a81f2fecfcb6f7044a9827
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364470);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id("CVE-2026-76488");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu02922");
  script_xref(name:"CISCO-SA", value:"cisco-sa-apic-info-priv-enAdB5vD");
  script_xref(name:"IAVA", value:"2026-A-1089");

  script_name(english:"Cisco Application Policy Infrastructure Controller Unauthorized File Access (cisco-sa-apic-info-priv-enAdB5vD)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Application Policy Infrastructure Controller (APIC) is affected by a
vulnerability.

  - A privilege escalation vulnerability exists in the export policies functionality due to insufficient access
    control to file system resources. An authenticated, remote attacker can exploit this, by submitting specially
    crafted values in specific UI fields, to gain root access to the affected device and managed switches.
    (CVE-2026-76488)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?61a0f190");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu02922");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu02922");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76488");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:application_policy_infrastructure_controller");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_apic_version.nbin");
  script_require_keys("installed_sw/Cisco APIC Software");

  exit(0);
}

include('ccf.inc');
include('http.inc');

var port = get_http_port(default:443);
var product_info = cisco::get_product_info(name:'Cisco APIC Software', port:port);

var vuln_ranges = [
  {'min_ver': '0.0',    'fix_ver': '5.99', 'fix_display': 'See vendor advisory'},
  {'min_ver': '6.0',    'fix_ver': '6.0(9h)'},
  {'min_ver': '6.1',    'fix_ver': '6.1(3f)'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwu02922',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);