PT-2017-17217 · Cisco · Cisco Telepresence Ix5000 Series

Published 2017-05-18 · Updated 2017-07-08 · CVE-2017-6652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence IX5000 Series version 8.2.0

Description A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The issue is due to insufficient input validation, which can be exploited using directory traversal techniques to read files within the filesystem.

Recommendations For Cisco TelePresence IX5000 Series version 8.2.0, update the software to a version that addresses the insufficient input validation issue. As a temporary workaround, consider restricting access to the web framework to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2017-6652

Affected Products

Cisco Telepresence Ix5000 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6652 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6652 · Vendor Advisory
• http://securitytracker.com/id/1038509 · Note
• http://securityfocus.com/bid/98519 · Note