According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities:

 - Multiple parameter injection vulnerabilities in the Cisco IOx application hosting environment. Due to    incomplete sanitization of parameters that are part of an application package, an authenticated, remote    attacker can use a specially crafted application package to execute arbitrary code as root on the    underlying host operating system. (CVE-2022-20718, CVE-2022-20719, CVE-2022-20723)

 - A path traversal vulnerability in the Cisco IOx application hosting environment. Due to a missing real    path check, an authenticated remote attacker can create a symbolic link within a deployed application to    read or execute arbitrary code as root on the underlying host operating system. (CVE-2022-20720)

 - A race condition in the Cisco IOx application hosting environment can allow an unauthenticated remote    attacker to bypass authentication and impersonate another authenticated user session. (CVE-2022-20724)

 - A cross-site scripting vulnerability in the web-based Local Manager interface of the Cisco IOx application    hosting environment can allow a remote attacker, authenticated with Local Manager credentials, to inject    malicious code into the system settings tab. (CVE-2022-20725)

 - A privilege escalation vulnerability in the Cisco IOS XE Software which allows an authenticated, local    attacker to elevate privileges from level 15 to root. (CVE-2022-20677)

 - A privilege escalation vulnerability in the Cisco IOx application hosting environment due to improper    input validation. An authenticated, local attacker can modify application content while the application    is loading to gain privileges equivalent to the root user. (CVE-2022-20727)

 - Multiple vulnerabilities in the Cisco IOx application hosting environment. Due to insufficient path    validation, an authenticated, remote attacker can send a specially requested command to the Cisco IOx API    to read the contents of any file on the host device filesystem. (CVE-2022-20721, CVE-2022-20722)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Cisco IOS XE Software IOx Application Hosting Environment (cisco-sa-iox-yuXQ6hFj)

high Nessus Plugin ID 160083

Version 1.10

Version 1.9

Version 1.9

Version 1.8

Version 1.10 Mar 5, 2024, 5:50 PM CVSS metrics ("CVSSv3 score" set to 7.2. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2022-20724" to none) Plugin Feed: 202403051750
Version 1.9 Oct 31, 2023, 1:53 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310311353
Version 1.9 Mar 5, 2024, 2:40 PM CVSS metrics ("CVSSv3 score" set to 7.2) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2022-20724" to none) Plugin Feed: 202403051440
Version 1.8 Oct 6, 2023, 10:25 AM IAVM reference Plugin Feed: 202310061025