Cisco Iox vulnerabilities

9 CVEs affecting Cisco Iox, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20076, published 2023-02-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-3853, published 2017-03-22. Critical severity, CVSS 9.8. EPSS: 8.7% chance of exploitation in the next 30 days. A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow…
CVE-2017-3851, published 2017-03-22. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an unauthenticated,…
CVE-2017-3852, published 2017-03-22. High severity, CVSS 8.1. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in…
CVE-2016-9199, published 2016-12-14. Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a targeted system. Affected Products: This…
CVE-2017-3805, published 2017-01-26. Medium severity, CVSS 5.3. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without…
CVE-2023-20076, published 2023-02-12. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This…
CVE-2020-3238, published 2020-06-03. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual…
CVE-2020-3233, published 2020-06-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack…
CVE-2020-3237, published 2020-06-03. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite arbitrary files in the virtual instance…