CVE-2017-3852

HIGH

Cisco IOx 1.0.0.0-1.1.0.0 - Authenticated Arbitrary File Write via Malicious Application Package

Title source: llm
STIX 2.1

Description

A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52317.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97014
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038109
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038108

Scores

CVSS v3 8.1
EPSS 0.0253
EPSS Percentile 83.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-20
Status published
Products (3)
cisco/iox 1.1\(0\)
cisco/iox 1.1.0
n/a/Cisco Application-Hosting Framework Cisco Application-Hosting Framework
Published Mar 22, 2017
Tracked Since Feb 18, 2026