PT-2022-2498 · Cisco · Cisco Roomos+1

Published 2022-05-04 · Updated 2022-05-11 · CVE-2022-20794

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the web engine of the affected software, which could allow a remote attacker to cause a denial of service condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destination. The vulnerability is also associated with URL redirection to an untrusted site, allowing a remote attacker to redirect a user to an arbitrary URL address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2022-02908

CVE-2022-20794

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 6

• https://osv.dev/vulnerability/CVE-2022-20794 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02908 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ROS-DOS-X7H7XhkK · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20794 · Security Note
• https://t.me/cvenotify/29691 · Telegram Post
• https://t.me/cibsecurity/41944 · Telegram Post