PT-2020-2867 · Cisco · Cisco Roomos+1

Published 2020-06-17 · Updated 2020-06-24 · CVE-2020-3336

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software (affected versions not specified)

Description A vulnerability in the software upgrade process could allow an authenticated, remote attacker to modify the filesystem, causing a denial of service (DoS) or gaining privileged access to the root filesystem. This issue is due to insufficient input validation. An attacker with administrative privileges could exploit this by sending requests with malformed parameters to the system using the console, Secure Shell (SSH), or web API. A successful exploit could allow the attacker to modify the device configuration or cause a DoS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-03021

CVE-2020-3336

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tp-cmd-inj-7ZpWhvZb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3336 · Security Note
• https://bdu.fstec.ru/vul/2020-03021 · Security Note
• https://t.me/cvenotify/4458 · Telegram Post