PT-2019-2438 · Cisco · Cisco Telepresence Codec (Tc)/Collaboration Endpoint (Ce)

Published 2019-06-19 · Updated 2019-10-09 · CVE-2019-1878

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software (affected versions not specified)

Description A vulnerability in the Cisco Discovery Protocol (CDP) implementation could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The issue is due to insufficient input validation of received CDP packets. An attacker could exploit this by sending crafted CDP packets to an affected device, potentially allowing the execution of arbitrary shell commands or scripts on the targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-02216

CVE-2019-1878

Affected Products

Cisco Telepresence Codec (Tc)/Collaboration Endpoint (Ce)

References · 7

• https://bdu.fstec.ru/vul/2019-02216 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1878 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-tele-shell-inj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1878 · Vendor Advisory
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note
• http://securityfocus.com/bid/108883 · Note