PT-2020-14769 · Cisco · Cisco Unified Ip Conference Station 7937G

Published 2020-08-10 · Updated 2024-08-04 · CVE-2020-16137

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified IP Conference Station 7937G versions 1-4-4-0 through 1-4-5-7

Description A privilege escalation issue allows attackers to reset the credentials for the SSH administrative console to arbitrary values. The product is end of life and users are advised to remove or upgrade it.

Recommendations For versions 1-4-4-0 through 1-4-5-7, remove or upgrade the product to mitigate the issue. As a temporary workaround, consider restricting access to the SSH administrative console until the product can be removed or upgraded.

Exploit

Fix

Related Identifiers

CVE-2020-16137

Affected Products

Cisco Unified Ip Conference Station 7937G

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_7937g_ssh_privesc.py · Exploit
• 🔥 https://blacklanternsecurity.com/2020-08-07-Cisco-Unified-IP-Conference-Station-7937G · Exploit
• 🔥 https://packetstormsecurity.com/files/158818/Cisco-7937G-Privilege-Escalation.html · Exploit
• https://cisco.com/c/en/us/products/collateral/collaboration-endpoints/unified-ip-phone-7940g/end_of_life_notice_c51-729487.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16137 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16137 · Vendor Advisory
• https://t.me/rnetsec/13061 · Telegram Post
• https://t.me/cybersecuritytechnologies/1569 · Telegram Post
• https://t.me/cvenotify/88992 · Telegram Post
• https://t.me/avleonovcom/756 · Telegram Post
• https://t.me/secharvester/9675 · Telegram Post
• https://t.me/defcon_news/54401 · Telegram Post
• https://t.me/defcon_news/54242 · Telegram Post