PT-2016-2319 · Cisco · Expressway+1

Published 2016-07-07 · Updated 2020-08-27 · CVE-2016-1444

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.1 through X8.7 Expressway versions X8.1 through X8.6

Description The issue exists due to insufficient input validation in the Mobile and Remote Access (MRA) component of the Cisco TelePresence Video Communication Server. This allows a remote attacker to bypass authentication using an arbitrary trusted certificate.

Recommendations For Cisco TelePresence Video Communication Server versions X8.1 through X8.7, update the software to a version that includes the fix for the issue. For Expressway versions X8.1 through X8.6, update the software to a version that includes the fix for the issue. As a temporary workaround, consider restricting access to the MRA component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01708

CVE-2016-1444

Affected Products

Cisco Telepresence Video Communication Server

Expressway

References · 6

• https://bdu.fstec.ru/vul/2016-01708 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1444 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-vcs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1444 · Security Note
• http://securityfocus.com/bid/91669 · Note
• http://securitytracker.com/id/1036237 · Note