PT-2017-16145 · Cisco · Cisco Iox

Published 2017-03-22 · Updated 2017-07-12 · CVE-2017-3851

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOx versions 1.0.0.0 through 1.1.0.0

Description A Directory Traversal issue in the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the affected virtual instance. The issue is due to insufficient input validation, and an attacker could exploit it by submitting crafted requests to the web interface. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the hosting router.

Recommendations For Cisco IOx versions 1.0.0.0 through 1.1.0.0, consider restricting access to the CAF web interface until a patch is available. As a temporary workaround, limit the submission of crafted requests to the CAF web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-3851

Affected Products

Cisco Iox

References · 6

• https://osv.dev/vulnerability/CVE-2017-3851 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3851 · Security Note
• http://securityfocus.com/bid/97013 · Note
• http://securitytracker.com/id/1038107 · Note
• http://securitytracker.com/id/1038106 · Note