PT-2021-7017 · Cisco · Cisco Telepresence Collaboration Endpoint (Ce)+1

Published 2021-11-02 · Updated 2022-05-04 · CVE-2022-20783

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description A vulnerability in the packet processing functionality could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This issue is due to insufficient input validation. An attacker could exploit this by sending crafted H.323 traffic to an affected device, potentially causing the device to reboot normally or into maintenance mode, resulting in a DoS condition.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE) Software, consider disabling the packet processing functionality until a patch is available. For Cisco RoomOS Software, restrict access to the H.323 traffic handling component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1287

CWE-20

Related Identifiers

BDU:2022-02974

CVE-2022-20783

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-20783 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20783 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02974 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022042127 · Note
• https://vuldb.com/?id.198312 · Note
• https://t.me/cibsecurity/41260 · Telegram Post