Unauthenticated session impersonation via token race

Authentication bypass in the Cisco IOx application hosting environment on Cisco IOS allows remote attackers to impersonate authenticated sessions through the upload API. A race in token allocation lets simultaneous upload calls collide with an administrator's application deployment and returns a valid session token to the attacker. Exploitation requires timing concurrent requests during deployment and can provide the privileges of the impersonated session, while Cisco reports no known malicious use.