PT-2015-7237 · Cisco+1 · Cisco Telepresence Video Communication Server (Vcs) Expressway+1

Published 2015-12-13 · Updated 2016-12-07 · CVE-2015-6413

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server (VCS) Expressway version X8.6

Description The issue allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page.

Recommendations For Cisco TelePresence Video Communication Server (VCS) Expressway version X8.6, consider restricting access to administrative pages until a fix is available. As a temporary workaround, limit the ability to upload TLP files to prevent potential exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-6413

Affected Products

Cisco Telepresence Video Communication Server (Vcs) Expressway

Tandberg Linux Package

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-6413 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-tvc · Vendor Advisory
• http://securitytracker.com/id/1034378 · Note
• http://securityfocus.com/bid/79088 · Note