PT-2017-16123 · Cisco · Cisco Telepresence Collaboration Endpoint

Published 2017-05-16 · Updated 2017-07-11 · CVE-2017-3825

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software versions CE8.1.1 through CE8.3.1

Description A vulnerability in the ICMP ingress packet processing could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service (DoS) condition. This is due to incomplete input validation for the size of a received ICMP packet. An attacker could exploit this by sending a crafted ICMP packet to the local IP address of the targeted endpoint, potentially causing calls to be dropped. The vulnerability affects either IPv4 or IPv6 ICMP traffic.

Recommendations For versions CE8.1.1 through CE8.3.1, update to a fixed software release to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-3825

Affected Products

Cisco Telepresence Collaboration Endpoint

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-3825 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3825 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-ctp · Vendor Advisory
• http://securitytracker.com/id/1038392 · Note
• http://securityfocus.com/bid/98293 · Note