PT-2022-2507 · Cisco · Cisco Roomos+1

Published 2022-05-04 · Updated 2022-05-11 · CVE-2022-20764

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the web engine of the affected software, which could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destination. The vulnerability is also associated with the failure to neutralize encrypted URI schemes on a web page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

CWE-84

Related Identifiers

BDU:2022-02917

CVE-2022-20764

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 7

• https://osv.dev/vulnerability/CVE-2022-20764 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ROS-DOS-X7H7XhkK · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02917 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20764 · Security Note
• https://t.me/cibsecurity/41929 · Telegram Post
• https://t.me/cvenotify/29693 · Telegram Post
• https://t.me/cvenotify/30055 · Telegram Post