CVE-2017-3852

A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52317.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/97014Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038108
• http://www.securitytracker.com/id/1038109
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf2Vendor Advisory
• http://www.securityfocus.com/bid/97014Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038108
• http://www.securitytracker.com/id/1038109
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf2Vendor Advisory

Published

Mar 22, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-3846A vulnerability in the Client Manager Server of Cisco Worklo…
• CVE-2017-3847A vulnerability in the web framework of Cisco Firepower Mana…
• CVE-2017-3848A vulnerability in the HTTP web-based management interface o…
• CVE-2017-3849A vulnerability in the Autonomic Networking Infrastructure (…
• CVE-2017-3850A vulnerability in the Autonomic Networking Infrastructure (…
• CVE-2017-3851A Directory Traversal vulnerability in the web framework cod…
• CVE-2017-3853A vulnerability in the Data-in-Motion (DMo) process installe…
• CVE-2017-3854A vulnerability in the mesh code of Cisco Wireless LAN Contr…8.8
• CVE-2017-3856A vulnerability in the web user interface of Cisco IOS XE 3.…
• CVE-2017-3857A vulnerability in the Layer 2 Tunneling Protocol (L2TP) par…7.5
• CVE-2017-3858A vulnerability in the web framework of Cisco IOS XE Softwar…
• CVE-2017-3859A vulnerability in the DHCP code for the Zero Touch Provisio…