PT-2015-2348 · Cisco · Cisco Telepresence Video Communication Server

Published 2015-10-12 · Updated 2017-01-04 · CVE-2015-6318

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.1 through X8.5.2

Description The issue exists due to insufficient input validation in the device's firmware, allowing a local attacker to read arbitrary files. Additionally, a symlink attack can be used to write to arbitrary files.

Recommendations For versions X8.5.1 and X8.5.2, consider restricting local access to the device until a patch is available. As a temporary workaround, restrict write access to sensitive files and directories to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-11713

CVE-2015-6318

Affected Products

Cisco Telepresence Video Communication Server

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151007-vcs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6318 · Security Note
• https://bdu.fstec.ru/vul/2015-11713 · Security Note
• http://securitytracker.com/id/1033781 · Note