PT-2016-2319 · Cisco · Expressway+1

Publicado 2016-07-07 · Atualizado 2020-08-27 · CVE-2016-1444

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.1 through X8.7 Expressway versions X8.1 through X8.6

Description The issue exists due to insufficient input validation in the Mobile and Remote Access (MRA) component of the Cisco TelePresence Video Communication Server. This allows a remote attacker to bypass authentication using an arbitrary trusted certificate.

Recommendations For Cisco TelePresence Video Communication Server versions X8.1 through X8.7, update the software to a version that includes the fix for the issue. For Expressway versions X8.1 through X8.6, update the software to a version that includes the fix for the issue. As a temporary workaround, consider restricting access to the MRA component until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-01708

CVE-2016-1444

Produtos afetados

Cisco Telepresence Video Communication Server

Expressway

Referências · 6

• https://bdu.fstec.ru/vul/2016-01708 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1444 · Aviso do Fabricante
• http://securityfocus.com/bid/91669 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-vcs · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1444 · Nota de Segurança
• http://securitytracker.com/id/1036237 · Nota