PT-2021-2988 · Cisco · Cisco Telepresence Collaboration Endpoint (Ce)+1

Published 2021-05-05 · Updated 2021-05-14 · CVE-2021-1532

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description A vulnerability in the video endpoint API (xAPI) could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system due to insufficient path validation of command arguments. An attacker could exploit this by sending a crafted command request to the xAPI, potentially allowing them to read the contents of any file on the device filesystem.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE) Software, consider restricting access to the xAPI until a fix is available. For Cisco RoomOS Software, consider disabling the xAPI functionality as a temporary workaround until a patch is available. Restrict access to sensitive files on the device filesystem to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-02576

CVE-2021-1532

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 4

• https://osv.dev/vulnerability/CVE-2021-1532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1532 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tp-rmos-fileread-pE9sL3g · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02576 · Security Note