PT-2020-2679 · Cisco · Cisco Iox

Published 2020-06-03 · Updated 2021-09-17 · CVE-2020-3238

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOx (affected versions not specified)

Description The issue is related to insufficient input validation of user-supplied application packages in the Cisco Application Framework component. This could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the device hosting Cisco IOx.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-02746

CVE-2020-3238

Affected Products

Cisco Iox

References · 5

• https://bdu.fstec.ru/vul/2020-02746 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3238 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3238 · Vendor Advisory
• https://t.me/cvenotify/4164 · Telegram Post