Detections
Analytics

Cisco TelePresence Collaboration Endpoint Software Command Injection Vulnerability (cisco-sa-20191016-tele-ce-cmdinj)

medium Nessus Plugin ID 130593

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, the Cisco TelePresence Collaboration Endpoint (CE) Cisco TelePresence Software is affected by a command injection vulnerability in the CLI due to insufficient input validation. An authenticated, local attacker can exploit this by authenticating as an administrative level user within the restricted shell and submitting malicious input to a specific command, allowing the attacker to execute previously staged code from the underlying filesystem.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvq29893

See Also

http://www.nessus.org/u?7c9f3fa3

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq29893

Plugin Details

Severity: Medium

ID: 130593

File Name: cisco-sa-20191016-tele-ce-cmdinj.nasl

Version: 1.4

Type: remote

Family: CISCO

Published: 11/7/2019

Updated: 7/30/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-15274

CVSS v3

Risk Factor: Medium

Base Score: 6.7

Temporal Score: 5.8

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:telepresence_ce

Required KB Items: Cisco/TelePresence_MCU/Device, Cisco/TelePresence_MCU/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 10/16/2019

Vulnerability Publication Date: 10/16/2019

Reference Information

CVE: CVE-2019-15274