PT-2017-17217 · Cisco · Cisco Telepresence Ix5000 Series

Publicado 2017-05-18 · Atualizado 2017-07-08 · CVE-2017-6652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence IX5000 Series version 8.2.0

Description A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The issue is due to insufficient input validation, which can be exploited using directory traversal techniques to read files within the filesystem.

Recommendations For Cisco TelePresence IX5000 Series version 8.2.0, update the software to a version that addresses the insufficient input validation issue. As a temporary workaround, consider restricting access to the web framework to minimize the risk of exploitation.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-20

CWE-22

Identificadores relacionados

CVE-2017-6652

Produtos afetados

Cisco Telepresence Ix5000 Series

Referências · 5

• http://securitytracker.com/id/1038509 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6652 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000 · Aviso do Fabricante
• http://securityfocus.com/bid/98519 · Nota
• https://osv.dev/vulnerability/CVE-2017-6652 · Aviso do Fabricante