PT-2016-4816 · Cisco · Cisco Telepresence Video Communication Server Expressway

Published 2016-08-08 · Updated 2017-08-16 · CVE-2016-1468

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server Expressway version X8.5.2

Description The administrative web interface in Cisco TelePresence Video Communication Server Expressway allows remote authenticated users to execute arbitrary commands via crafted fields.

Recommendations For Cisco TelePresence Video Communication Server Expressway version X8.5.2, consider restricting access to the administrative web interface until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2016-1468

Affected Products

Cisco Telepresence Video Communication Server Expressway

References · 5

• https://osv.dev/vulnerability/CVE-2016-1468 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-vcse · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1468 · Security Note
• http://securitytracker.com/id/1036529 · Note
• http://securityfocus.com/bid/92274 · Note