PT-2017-16145 · Cisco · Cisco Iox

Publicado 2017-03-22 · Atualizado 2017-07-12 · CVE-2017-3851

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOx versions 1.0.0.0 through 1.1.0.0

Description A Directory Traversal issue in the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the affected virtual instance. The issue is due to insufficient input validation, and an attacker could exploit it by submitting crafted requests to the web interface. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the hosting router.

Recommendations For Cisco IOx versions 1.0.0.0 through 1.1.0.0, consider restricting access to the CAF web interface until a patch is available. As a temporary workaround, limit the submission of crafted requests to the CAF web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-3851

Produtos afetados

Cisco Iox

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-3851 · Aviso do Fabricante
• http://securityfocus.com/bid/97013 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf1 · Aviso do Fabricante
• http://securitytracker.com/id/1038107 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3851 · Nota de Segurança
• http://securitytracker.com/id/1038106 · Nota