{
  "document": {
    "acknowledgments": [
      {
        "summary": "This vulnerability was found during internal security testing."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an  authenticated, remote attacker to write or modify arbitrary files in the  virtual instance that is running on the affected device.\r\n\r\nThe vulnerability is due to insufficient input validation of  user-supplied application packages. An attacker who can upload a  malicious package within Cisco IOx could exploit the vulnerability to  modify arbitrary files. The impacts of a successful exploit are limited  to the scope of the virtual instance and do not affect the device that  is hosting Cisco IOx.\r\n\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "This vulnerability affects the following Cisco products if they are running a Cisco IOx Application Framework release earlier than Release 1.9.0:\r\n\r\n800 Series Industrial Integrated Services Routers (Industrial ISRs)\r\n800 Series Integrated Services Routers (ISRs)\r\n1000 Series Connected Grid Routers (CGR1000) Compute Module\r\nIC3000 Industrial Compute Gateway\r\nIndustrial Ethernet (IE) 4000 Series Switches\r\nIOS XE-based devices:\r\n1000 Series ISRs\r\n4000 Series ISRs\r\nASR 1000 Series Aggregation Services Routers\r\nCatalyst 9x00 Series Switches\r\nCatalyst IE3400 Rugged Series Switches\r\nEmbedded Services 3300 Series Switches\r\n\r\nIR510 WPAN Industrial Routers\r\n\r\nFor information about fixed Cisco platform releases, see the Fixed Software [\"#fs\"] section of this advisory.\r\n  Assess the Device Status\r\nCisco IOS XE-Based Devices\r\n\r\nFor the following Cisco IOS XE-based devices, administrators can use the privileged exec command show iox-service to determine whether the Cisco IOx Application Framework is enabled on the device:\r\n\r\n1000 Series ISRs\r\n4000 Series ISRs\r\nASR 1000 Series Aggregation Services Routers\r\nCatalyst 9x00 Series Switches\r\nCatalyst IE3400 Rugged Series Switches\r\nEmbedded Services 3300 Series Switches\r\n\r\nThe following output of the show iox-service command shows a device with the Cisco IOx Application Framework enabled:\r\n\r\n\r\nswitch# show iox-service\r\n.\r\n.\r\n.\r\nIOx Infrastructure Summary:\r\n---------------------------\r\nIOx service (CAF)    : Running\r\nIOx service (HA)     : Running\r\nIOx service (IOxman) : Running\r\nLibvirtd             : Running\r\nDockerd              : Running\r\n\r\nThe framework is enabled if IOx service (CAF) is in the Running state.\r\n\r\nCisco IE 4000 Series Switches\r\n\r\nAdministrators can use the privileged exec command show iox detail to determine whether the Cisco IOx Application Framework is enabled on the device. The following output of the show iox detail command shows a device with the Cisco IOx Application Framework enabled:\r\n\r\n\r\nswitch# show iox detail\r\n.\r\n.\r\n.\r\nIOx Processes State:\r\n--------------------\r\ncaf                    : Running\r\nioxhad                 : Running\r\nlibvirtd               : Running\r\nmonit                  : Running\r\n\r\nThe framework is enabled if caf is in the Running state.\r\n\r\nCisco IR510 WPAN Industrial Router\r\n\r\nAdministrators who have access to an IOx (Linux) terminal can use following CLI commands.\r\n\r\nThe following command checks the IOx release:\r\n\r\n\r\n#vi /etc/platform/version\r\n\r\nThe following command checks the Cisco IOx Application Framework status:\r\n\r\n\r\n#monit summary\r\n\r\nAdministrators can also check the IOx status by using get TLV from the Constrained Application Protocol (CoAP) Simple Management Protocol (CSMP) GUI field tool/device manager or from the Field Network Director (FND). The numerical value of the TLV for checking the IOx host status is 146:\r\n\r\n\r\n146\r\n\r\nmessage IoxHostStatus {\r\nrequired uint32 status = 1;\r\noptional string version = 2;\r\noptional uint32 upTime = 3;\r\n}\r\n\r\nIn the preceding TLV, a required uint32 status of 1 indicates that the host is in an up state and operational.\r\n\r\nThe following TLV is used to get the IOx host status:\r\n\r\n\r\n0 \u2013 unheard, 1 \u2013 up, 2 \u2013 down, 3 \u2013 stopped, 4 \u2013 disabled\r\nversion: Client firmware version\r\nupTime: Client\u2019s uptime\r\n\r\nCisco CGR1000 Compute Module\r\n\r\nAdministrators can see the status of the IOx functionality by using the show iox host list detail | include IOX Server is running CLI command as shown in the following example:\r\n\r\n\r\nCGR1000#show iox host list detail | include IOX Server is running\r\nIOX Server is running.  Process ID: 305\r\nCGR1000#\r\n\r\nCisco IC3000 Industrial Compute Gateway\r\n\r\nOn the Cisco IC3000 Industrial Compute Gateway, the Cisco IOx functionality is enabled by default. Administrators can see the status of the IOx functionality via the show iox summary CLI command as shown in the following example:\r\n\r\n\r\nic3k#show iox summary\r\nIOx Infrastructure Summary:\r\n---------------------------\r\neid: IC3000-2C2F-K9+FOC2227Y304\r\npfm: IC3000-2C2F-K9\r\ns/n: FOC2227Y304\r\nimages: Lnx: 1.0.1., IOx: 1.7.0:r/1.7.0.0:fc6e9cf\r\nboot: 2018-09-17 17:37:55\r\ntime: 2018-09-18 18:07:28\r\nload: 18:07:28 up 1 day, 29 min, 0 users, load average: 0.32, 0.11, 0.02\r\nmemory: ok, used: 481/7854 (6%)\r\ndisk: ok, used: /:270305/338869 (79%), /software:57272/87462892 (0%)\r\nprocess: warning, running: 4/5, failed: sshd\r\nnetworking: ok\r\nlogs: ok, errors: caf (0)\r\napps: ok,",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.\r\n\r\nCustomers who do not need to use the Cisco IOx Application Framework can mitigate this vulnerability by disabling IOx on the device by using the no iox configuration command.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:\r\nhttps://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n      Fixed Releases\r\nCisco fixed this vulnerability in Cisco IOx Application Framework releases 1.9.0 and later.\r\n\r\nThe following table indicates the first fixed software release that supports Cisco IOx Application Framework Release 1.9.0 or later.\r\n        Cisco Platform  Release That Introduced Support for Cisco IOx Application Framework Release 1.9.0 or Later          800 Series Industrial ISRs  Cisco IOS Software Release 15.9(3)M      800 Series ISRs  Not fixed; IOx has reached end of life on the Cisco 800 Series ISRs.      CGR1000 Compute Module  IOx image for CGR1000 Release 1.10.0.6      IC3000 Industrial Compute Gateway  Industrial Compute Gateway Software Release 1.2.1      IE 4000 Series Switches  Cisco IOS Software Release 15.2.(7a)E0b      IOS XE devices:\r\n1000 Series ISRs\r\n4000 Series ISRs\r\nASR 1000 Series Aggregation Services Routers\r\nCatalyst 9x00 Series Switches\r\nCatalyst IE3400 Rugged Series Switches\r\nEmbedded Services 3300 Series Switches\r\n    Cisco IOS XE Software Release 17.2(1)      IR510 WPAN Industrial Routers  IR510 Operating System Release 6.1.27",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "This vulnerability was found during internal security testing.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco IOx Application Framework Arbitrary File Creation Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories and Alerts page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco IOx Application Framework Arbitrary File Creation Vulnerability",
    "tracking": {
      "current_release_date": "2020-06-03T16:00:00+00:00",
      "generator": {
        "date": "2022-09-03T03:09:58+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-caf-3dXM8exv",
      "initial_release_date": "2020-06-03T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2020-05-06T16:26:04+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco IOx",
            "product": {
              "name": "Cisco IOx ",
              "product_id": "CSAFPID-265038"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-3238",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvr02052"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-265038"
        ]
      },
      "release_date": "2020-06-03T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-265038"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-265038"
          ]
        }
      ],
      "title": "vuln-CVE-2020-3238"
    }
  ]
}