Sean Morland

**Name of the Vulnerable Software and Affected Versions** Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) version 14.0 **Description** A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) exists due to insufficient validation of user-supplied input. This could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack, resulting in remote code execution on an affected device. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges. **Recommendations** For Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) version 14.0, consider disabling the web-based management interface until a patch is available. Restrict access to the management interface to minimize the risk of exploitation. Avoid using the interface for any critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Evolved Programmable Network Manager (affected versions not specified) Cisco Identity Services Engine (affected versions not specified) Cisco Prime Infrastructure (affected versions not specified) **Description** The issue is related to multiple vulnerabilities in the restricted shell of the affected Cisco products. These vulnerabilities could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. The vulnerabilities exist due to the lack of measures to neutralize special elements used in the operating system command. **Recommendations** For Cisco Evolved Programmable Network Manager, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Identity Services Engine, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Prime Infrastructure, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (affected versions not specified) Cisco Evolved Programmable Network Manager (affected versions not specified) Cisco Prime Infrastructure (affected versions not specified) **Description** The issue exists due to the failure to neutralize special elements used in an operating system command. This could allow an attacker to elevate their privileges. Multiple vulnerabilities in the restricted shell of the affected products could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. **Recommendations** For Cisco Identity Services Engine, consider disabling the restricted shell until a patch is available. For Cisco Evolved Programmable Network Manager, restrict access to the underlying operating system to minimize the risk of exploitation. For Cisco Prime Infrastructure, avoid using the restricted shell in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.