PT-2017-1544 · Cisco · Cisco Telepresence Server

Published 2017-03-17 · Updated 2019-10-03 · CVE-2017-3815

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Server versions prior to 4.3

Description The issue is related to insufficient access control in the Cisco TelePresence Server software, which could allow a remote attacker to emulate server endpoints. This could potentially be exploited by an unauthenticated, remote attacker.

Recommendations For versions prior to 4.3, update to Cisco TelePresence Software Release 4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-264

Related Identifiers

BDU:2017-00689

CVE-2017-3815

Affected Products

Cisco Telepresence Server

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-tps · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3815 · Security Note
• https://bdu.fstec.ru/vul/2017-00689 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3815 · Vendor Advisory
• http://securityfocus.com/bid/96922 · Note
• http://securitytracker.com/id/1038035 · Note