Cisco IOS iox Command Injection Vulnerability (cisco-sa-20160921-iox)

A vulnerability exists in the iox command in Cisco IOS and IOS XE Software that could allow an authenticated, local attacker to perform command injection into the IOx Linux guest operating system (GOS).
This vulnerability is due to insufficient input validation of iox command line arguments.

An attacker could exploit this vulnerability by providing crafted options to the iox command. An exploit could allow the attacker to execute commands of their choice in the Linux GOS.

Refer to Cisco advisory cisco-sa-20160921-iox for updates and patch information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

cisco-sa-20160921-iox: CISCO IOS