PT-2019-3964 · Cisco · Cisco Roomos+2

Publicado 2019-11-06 · Atualizado 2019-12-10 · CVE-2019-15288

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) (affected versions not specified) Cisco TelePresence Codec (TC) (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description A vulnerability in the CLI of Cisco devices could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The issue is due to insufficient input validation. An attacker could exploit this by including specific arguments when opening an SSH connection to an affected device, potentially gaining unrestricted user access to the restricted shell.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE), update to a version that addresses the insufficient input validation issue. For Cisco TelePresence Codec (TC), update to a version that addresses the insufficient input validation issue. For Cisco RoomOS Software, update to a version that addresses the insufficient input validation issue. As a temporary workaround, consider restricting SSH connections to affected devices until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-04495

CVE-2019-15288

Produtos afetados

Cisco Roomos

Cisco Telepresence Codec

Cisco Telepresence Collaboration Endpoint

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15288 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15288 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-telepres-roomos-privesc · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04495 · Nota de Segurança