PT-2015-1976 · Cisco · Cisco Telepresence Video Communication Server

Published 2015-08-26 · Updated 2017-01-04 · CVE-2015-6261

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.2

Description The issue is related to a lack of protection for service data in the Cisco TelePresence Video Communication Server software. It allows a remote, authenticated attacker to bypass existing access restrictions and read configuration files by using the Mobile and Remote Access (MRA) role during the setup of a TFTP connection.

Recommendations For version X8.5.2, consider restricting access to the MRA role to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the MRA role for TFTP sessions.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11322

CVE-2015-6261

Affected Products

Cisco Telepresence Video Communication Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-6261 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40620 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11322 · Security Note
• http://securitytracker.com/id/1033379 · Note