At the time of publication, this vulnerability affected Cisco IOS and IOS XE Software if they were configured with the Cisco IOx application hosting environment and have the HTTP Server feature enabled. The Cisco IOx application hosting environment is not enabled by default.
At the time of publication, this vulnerability also affected the following Cisco products:
- 800 Series Industrial ISRs
- Catalyst 9100 Family of Access Points (COS-AP)
- CGR1000 Compute Modules
- IC3000 Industrial Compute Gateways
- IR510 WPAN Industrial Routers
For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
Determine Whether the IOx Application Hosting Environment Is Enabled
Option 1: Use the show iox-service CLI command.
To determine the status of IOx functionality, use the show iox-service command in privileged EXEC mode, as shown in the following example:
Router#show iox-service IOx Infrastructure Summary:
---------------------------
IOx service (CAF) : Running
IOx service (HA) : Running
IOx service (IOxman) : Running
Libvirtd : Running
If IOx service (CAF) is in Running state, the device may be affected by this vulnerability. Proceed to Determine the HTTP Server Configuration.
If any of the following statements is true, the device is not affected by this vulnerability:
- IOx service (CAF) is in Not Running state.
- The show iox-service privileged EXEC mode command returns no output.
- The show iox-service privileged EXEC mode command returns an error.
Option 2: Use the iox configuration command.
As an alternative, check the running configuration for the iox configuration command, as shown in the following example:
Router#sh run | include iox
iox
If the output contains a line with only iox, as shown in the example, the device may be affected by this vulnerability. Proceed to Determine the HTTP Server Configuration.
If the iox configuration command does not return output or returns an error, the device is not affected by this vulnerability.
Determine the HTTP Server Configuration
To determine whether the HTTP Server feature is enabled for a device, log in to the device and use the show running-config | include ip http server|secure|active command in the CLI to check for the presence of the ip http server command or the ip http secure-server command in the global configuration. If either command is present, the HTTP Server feature is enabled for the device.
The following example shows the output of the show running-config | include ip http server|secure|active command for a device that has the HTTP Server feature enabled:
Router# show running-config | include ip http server|secure|active
ip http server
ip http secure-server
Note: The presence of either command or both commands in the device configuration indicates that the web UI feature is enabled.
If the ip http server command is present and the configuration also contains ip http active-session-modules none, the vulnerability is not exploitable over HTTP.
If the ip http secure-server command is present and the configuration also contains ip http secure-active-session-modules none, the vulnerability is not exploitable over HTTPS.
Restore the IOx Application Environment
The Cisco IOx application hosting environment will not recover without user intervention. It must be restarted with the no iox and then iox configuration commands, as shown in the following example:
Router(config)# no iox
Router(config)# iox
