PT-2016-1194 · Cisco · Cisco Telepresence Video Communication Server

Published 2016-02-09 · Updated 2016-12-06 · CVE-2016-1316

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server (VCS) versions X8.1 through X8.7

Description The issue is related to the lack of protection for service data, allowing remote attackers to obtain sensitive call-statistics information via a direct request to an unspecified URL. This can be achieved by sending a specially crafted GET request.

Recommendations For versions X8.1 through X8.7, consider restricting access to the URL that provides call-statistics information until a patch is available. As a temporary workaround, limit the exposure of the Cisco TelePresence Video Communication Server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00455

CVE-2016-1316

Affected Products

Cisco Telepresence Video Communication Server

References · 5

• https://osv.dev/vulnerability/CVE-2016-1316 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160208-vcs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1316 · Security Note
• https://bdu.fstec.ru/vul/2016-00455 · Security Note
• http://securitytracker.com/id/1034956 · Note