PT-2019-1380 · Cisco · Cisco Telepresence Management Suite

Published 2019-02-06 · Updated 2019-10-09 · CVE-2019-1660

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Management Suite (TMS) software (affected versions not specified)

Description A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The issue is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this by sending crafted SOAP calls to the affected device, potentially allowing access to system management tools, which should normally be prohibited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

CWE-264

Related Identifiers

BDU:2019-00742

CVE-2019-1660

Affected Products

Cisco Telepresence Management Suite

References · 5

• https://bdu.fstec.ru/vul/2019-00742 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-tms-soap · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1660 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1660 · Vendor Advisory
• http://securityfocus.com/bid/106918 · Note