PT-2019-2438 · Cisco · Cisco Telepresence Codec (Tc)/Collaboration Endpoint (Ce)

Publicado 2019-06-19 · Atualizado 2019-10-09 · CVE-2019-1878

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software (affected versions not specified)

Description A vulnerability in the Cisco Discovery Protocol (CDP) implementation could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The issue is due to insufficient input validation of received CDP packets. An attacker could exploit this by sending crafted CDP packets to an affected device, potentially allowing the execution of arbitrary shell commands or scripts on the targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2019-02216

CVE-2019-1878

Produtos afetados

Cisco Telepresence Codec (Tc)/Collaboration Endpoint (Ce)

Referências · 7

• https://bdu.fstec.ru/vul/2019-02216 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1878 · Nota de Segurança
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-tele-shell-inj · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1878 · Aviso do Fabricante
• http://securityfocus.com/bid/108883 · Nota