PT-2015-2348 · Cisco · Cisco Telepresence Video Communication Server

Publicado 2015-10-12 · Atualizado 2017-01-04 · CVE-2015-6318

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.1 through X8.5.2

Description The issue exists due to insufficient input validation in the device's firmware, allowing a local attacker to read arbitrary files. Additionally, a symlink attack can be used to write to arbitrary files.

Recommendations For versions X8.5.1 and X8.5.2, consider restricting local access to the device until a patch is available. As a temporary workaround, restrict write access to sensitive files and directories to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-11713

CVE-2015-6318

Produtos afetados

Cisco Telepresence Video Communication Server

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151007-vcs · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6318 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11713 · Nota de Segurança
• http://securitytracker.com/id/1033781 · Nota