PT-2020-4624 · Cisco · Cisco Telepresence Collaboration Endpoint (Ce)

Published 2020-11-04 · Updated 2020-11-19 · CVE-2020-26086

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified)

Description A vulnerability in the video endpoint API (xAPI) could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The issue is due to improper storage of sensitive information. An attacker could exploit this by accessing information that should not be accessible to users with low privileges, potentially gaining access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2020-05173

CVE-2020-26086

Affected Products

Cisco Telepresence Collaboration Endpoint (Ce)

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tele-info-DrEGLpDQ · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05173 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26086 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26086 · Vendor Advisory
• https://t.me/cvenotify/5288 · Telegram Post
• https://t.me/cibsecurity/16009 · Telegram Post