Path Traversal in Cisco Iox
CVE-2017-3851
A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the CAF in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted requests to the CAF web interface. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52302.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.052 (91.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Cisco Iox — versions 1.1\(0\), 1.1.0
- N/a Cisco Application-hosting Framework — versions Cisco Application-Hosting Framework
Weakness classification (CWE)
References
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-3851?
- CVE-2017-3851 is a high-severity vulnerability in Cisco Iox, classified under Path Traversal. CVSS score: 7.5/10. Published 2017-03-22.
- How severe is CVE-2017-3851?
- High severity. CVSS v3 base score is 7.5 out of 10.