CVE-2020-3238

A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance that is running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the device that is hosting Cisco IOx.

• CWE-20
• CWE-20

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exvVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exvVendor Advisory

Published

Jun 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3232A vulnerability in the Simple Network Management Protocol (S…7.7
• CVE-2020-3233A vulnerability in the web-based Local Manager interface of …5.4
• CVE-2020-3234A vulnerability in the virtual console authentication of Cis…8.8
• CVE-2020-3235A vulnerability in the Simple Network Management Protocol (S…7.7
• CVE-2020-3236A vulnerability in the CLI of Cisco Enterprise NFV Infrastru…6.7
• CVE-2020-3237A vulnerability in the Cisco Application Framework component…6.3
• CVE-2020-3239Multiple vulnerabilities in the REST API of Cisco UCS Direct…8.8
• CVE-2020-3240Multiple vulnerabilities in the REST API of Cisco UCS Direct…7.3
• CVE-2020-3241A vulnerability in the orchestration tasks of Cisco UCS Dire…6.5
• CVE-2020-3242A vulnerability in the REST API of Cisco UCS Director could …4.9
• CVE-2020-3243Multiple vulnerabilities in the REST API of Cisco UCS Direct…9.8
• CVE-2020-3244A vulnerability in the Enhanced Charging Service (ECS) funct…5.3